拖了很久的异构pwn，打算用*ctf2021的一道栈溢出来入门

环境准备

1
2
3
4
5
6
$gdb-multiarch -v
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

测试栈溢出

直接用题目给的qemu-riscv64运行即可

1
2
3
4
$./qemu-riscv64 -g 1234 ./main 
Input the flag: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
You are wrong ._.

用gef调试方便riscv寄存器

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
$gdb-multiarch 

gef➤  file main
Reading symbols from main...
(No debugging symbols found in main)
gef➤  set architecture riscv:rv64 
The target architecture is assumed to be riscv:rv64
gef➤  target remote :1234
Remote debugging using :1234
0x00000000000101c0 in ?? ()

gef➤  c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x6161616161616160 in ?? ()

gef➤  p $pc
$1 = (void (*)()) 0x6161616161616160
gef➤

没有NX，所以一般的思路都是ret2shellcode

qemu-user的各种地址在同一个环境下都是固定的，包括栈地址，所以需要知道远端的栈地址，然后把shellcode放在栈上

题目给了远程环境的docker，可以本地调试得到远端地址