0x1 虚拟机安装
以经典款ubuntu18为例。
略
0x2 ubuntu换源
对于ubuntu18：
备份并编辑sources.list文件
cp /etc/apt/sources.list /etc/apt/sources.list.bck
gedit /etc/apt/sources.list
以下是各镜像源sources.list的参考配置：（内容均来自官网，任选其一即可）
中科大镜像源：
# 默认注释了源码仓库，如有需要可自行取消注释
deb https://mirrors.ustc.edu.cn/ubuntu/ bionic main restricted universe multiverse
# deb-src https://mirrors.ustc.edu.cn/ubuntu/ bionic main restricted universe multiverse
deb https://mirrors.ustc.edu.cn/ubuntu/ bionic-security main restricted universe multiverse
# deb-src https://mirrors.ustc.edu.cn/ubuntu/ bionic-security main restricted universe multiverse
deb https://mirrors.ustc.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
# deb-src https://mirrors.ustc.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
deb https://mirrors.ustc.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
# deb-src https://mirrors.ustc.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
# 预发布软件源，不建议启用
# deb https://mirrors.ustc.edu.cn/ubuntu/ bionic-proposed main restricted universe multiverse
# deb-src https://mirrors.ustc.edu.cn/ubuntu/ bionic-proposed main restricted universe multiverse
清华镜像源
# 默认注释了源码镜像以提高 apt update 速度，如有需要可自行取消注释
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-updates main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-backports main restricted universe multiverse
deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-security main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-security main restricted universe multiverse
# 预发布软件源，不建议启用
# deb https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-proposed main restricted universe multiverse
# deb-src https://mirrors.tuna.tsinghua.edu.cn/ubuntu/ bionic-proposed main restricted universe multiverse
阿里镜像源
deb http://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic main restricted universe multiverse
deb http://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-security main restricted universe multiverse
deb http://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-updates main restricted universe multiverse
# deb http://mirrors.aliyun.com/ubuntu/ bionic-proposed main restricted universe multiverse
# deb-src http://mirrors.aliyun.com/ubuntu/ bionic-proposed main restricted universe multiverse
deb http://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse
deb-src http://mirrors.aliyun.com/ubuntu/ bionic-backports main restricted universe multiverse
如要用于其他版本，把 bionic 换成其他版本代号即可: 22.04：jammy；20.04：focal；18.04：bionic；16.04：xenial；14.04：trusty
更改完 sources.list 文件后，运行 sudo apt-get update 更新索引以生效。
0x3 安装pwn基本组件
python-pwntools
python2.7环境下的pwntools:
sudo apt-get install python
sudo apt-get install python-pip
pip install pwntools -i https://pypi.tuna.tsinghua.edu.cn/simple
ROPgadget
一款好用的查找ROP代码段的小工具
sudo apt install git
git clone https://github.com/JonathanSalwan/ROPgadget.git #r如果太慢的话，可以克隆到gitee仓库，再用git下载
cd ROPgadget
sudo python setup.py install
Or：
pip install ropgadget
ROPgadget
使用：
查找可存储寄存器的代码
ROPgadget --binary [pro] --only 'pop|ret' | grep 'eax'
ROPgadget --binary [pro] | grep 'rdi'
查找字符串
ROPgadget --binary rop --string "/bin/sh"
查找有int 0x80的地址
ROPgadget --binary rop --only 'int'
one_gadget
用来查找大型可执行文件里面是否可以有直接获得shell的代码段
安装：
git clone https://github.com/david942j/one_gadget.git
sudo apt-get install ruby
sudo gem install one_gadget
使用：
one_gadget libc.xxx.so
gdb插件
peda/pwndbg: 可以让gdb变得更强。
#创建文件夹
mkdir ~/gdbtools
cd ~/gdbtools
#peda:
cd ~/gdbtools
git clone https://github.com/longld/peda.git
echo "source ~/gdbtools/peda/peda.py" >> ~/.gdbinit
#pwndbg
cd ~/gdbtools
git clone https://github.com/pwndbg/pwndbg.git
cd pwndbg
./setup.sh
#gef
#下载 `gef.sh` 并执行
cd ~/gdbtools
wget -q -O- https://github.com/hugsy/gef/raw/master/gef.sh | sh
# 下载 `gef.py`, 并将其 `source` 写入 `.gdbinit`
wget -q -O ~/gdbtools/.gdbinit-gef.py https://github.com/hugsy/gef/raw/master/gef.py
echo source ~/gdbtools/.gdbinit-gef.py >> ~/.gdbinit
