pwntools笔记

sh = porcess("./test")#连接本地程序
sh = remote("127.0.0.1",10001)#远程连接
sh.close()#关闭连接

sh.send(data)#发送数据
sh.sendline(data)#发送一行数据，相当于在数据后面加\n
sh.recv(numb = 2048, timeout = dufault)#接受数据，numb指定接收的字节，timeout指定超时时间
sh.recvline(keepends=True)#接受一行数据，keepends为是否保留行尾的\n
sh.recvuntil("Hello,World\n",drop=fasle)#接受数据直到我们设置的标志出现
sh.recvall()#一直接收直到EOF
sh.recvrepeat(timeout = default)#持续接受直到EOF或timeout
sh.interactive()#直接进行交互，相当于回到shell的模式，在取得shell之后使用

>>> e = ELF('/bin/cat')
>>> print hex(e.address)  # 文件装载的基地址
0x400000
>>> print hex(e.symbols['write']) # 函数地址
0x401680
>>> print hex(e.got['write']) # GOT表的地址
0x60b070
>>> print hex(e.plt['write']) # PLT的地址
0x401680
>>> print hex(e.search('/bin/sh').next())# 字符串/bin/sh的地址

#libc相关
libc = e.libc
libc.address = libc_start_main_addr - libc.symbols['__libc_start_main']
libc.symbols['system']
next(libc.search('/bin/sh'))

>>> asm('nop')
'\x90'
>>> asm('nop', arch='arm')
'\x00\xf0 \xe3'

>>> context.arch      = 'i386'
>>> context.os        = 'linux'
>>> context.endian    = 'little'
>>> context.word_size = 32

>>> print disasm('6a0258cd80ebf9'.decode('hex'))
   0:   6a 02                   push   0x2
   2:   58                      pop    eax
   3:   cd 80                   int    0x80
   5:   eb f9                   jmp    0x0

>>> print shellcraft.i386.nop().strip('\n')
    nop
>>> print shellcraft.i386.linux.sh()
    /* push '/bin///sh\x00' */
    push 0x68
    push 0x732f2f2f
    push 0x6e69622f
...

from pwn import *
context(os='linux',arch='amd64')
shellcode = asm(shellcraft.sh())

或者

from pwn import *
shellcode = asm(shellcraft.amd64.linux.sh())

elf = ELF('ropasaurusrex')
rop = ROP(elf)
rop.read(0, elf.bss(0x80))
rop.dump()
# ['0x0000:        0x80482fc (read)',
#  '0x0004:       0xdeadbeef',
#  '0x0008:              0x0',
#  '0x000c:        0x80496a8']
str(rop)
# '\xfc\x82\x04\x08\xef\xbe\xad\xde\x00\x00\x00\x00\xa8\x96\x04\x08'

if args.M:
        gdb.attach(p)

context.log_level = 'DEBUG'