from pwn import *
context.arch = 'amd64'
def debug(addr,PIE=True):
text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(p.pid)).readlines()[2], 16)
if PIE:
info("b* " + hex(text_base+addr))
gdb.attach(p,'b *{}'.format(hex(text_base+addr)))
else:
gdb.attach(p,"b *{}".format(hex(addr)))
def cmd(command):
p.sendlineafter(">> ", str(command))
def add(sz,content):
cmd(1)
p.sendlineafter(": ", str(idx))
p.sendafter(": ", content)
def dele(idx):
cmd(3)
p.sendlineafter(": ", str(idx))
def show(idx):
cmd(2)
p.sendlineafter(": ",str(idx))
def main(host,off,port=8888):
global p
if host:
p = remote(host,port)
else:
p = process("./baby_diary")
gdb.attach(p)
# debug(0x32A0)
p.interactive()
if __name__ == "__main__":
libc = ELF("/lib/x86_64-linux-gnu/libc.so.6",checksec=False)
main(args['REMOTE'],offset)
PWN收发脚本例子
最新推荐文章于 2024-06-14 23:40:09 发布