PWN堆题换libc方法

patchelf

1 2	patchelf --set-interpreter ld-2.23.so FILENAME patchelf --replace-needed libc.so.6 FILENAME

基于pwndocker的换libc脚本

#! /bin/bash

if [[ $# < 1 ]]; then
    echo "Usage: ./chlibc [your_elf] [libc_version] [arch]"
    echo "2.19  2.23  2.24  2.27  2.28  2.29  2.30"
    exit
fi

echo $2
#2.19  2.23  2.24  2.27  2.28  2.29  2.30
arch=$3
libc=$2
file=$1

echo "Change $file to libc $libc"
if [[ $libc != '' ]]; then
    if [[ $arch == '32' ]];then
        patchelf --set-interpreter /glibc/$libc/$arch/lib/ld-$libc.so $file
        patchelf --replace-needed  libc.so.6  /glibc/$libc/$arch/lib/libc-$libc.so $file
    else
        arch=64
        patchelf --set-interpreter /glibc/$libc/$arch/lib/ld-linux-x86-64.so.2 $file
        patchelf --replace-needed  libc.so.6  /glibc/$libc/$arch/lib/libc-$libc.so $file
    fi
else
    echo "Change as default!"
    patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 $file
fi
echo "Finished!"