#导入所需库
#--------------------------------------------------------------------------------
from pwn import*
from LibcSearcher import*
from ctypes import*
from struct import*
import time

#设置context
#--------------------------------------------------------------------------------
context(arch='', os='linux', log_level='debug', terminal=['tmux', 'splitw', '-h'])

#设置是否本地还是远程,并操作、解析相应文件
#--------------------------------------------------------------------------------
pwn_file=''
libc_file=''
elf=ELF(pwn_file)
libc=ELF(libc_file)
rop=ROP(libc)

flag=1
if flag:
    io=process(pwn_file)
else:
    ip=''
    port=
    io=remote(ip,port)

#设置自定义函数
#--------------------------------------------------------------------------------
#gdb调试
def debug():
    #gdb.attach(io)
    #gdb.attach(io,'b *$rebase(0x1234)')
    #gdb.attach(io,'b main')
    pause()
#lambda表达式
s 		= 	lambda data 				: io.send(data)
sa 		= 	lambda delim,data 			: io.sendafter(str(delim), data)
sl 		= 	lambda data 				: io.sendline(data)
sla 	= 	lambda delim,data 			: io.sendlineafter(str(delim), data)
r 		= 	lambda num 					: io.recv(num)
rl		=	lambda 						: io.recvline()
ru 		= 	lambda delims, drop = True 	: io.recvuntil(delims, drop)
leak 	= 	lambda name,addr 			: log.success('{} = {:#x}'.format(name, addr))
ur32 	= 	lambda data					: u32(io.recv(data).rjust(4,b'\x00'))
ur64 	= 	lambda data 				: u64(io.recv(data).rjust(8,b'\x00'))
uul32 	= 	lambda 						: u32(io.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
uul64 	= 	lambda 						: u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu64    =   lambda data                 : u64(data.ljust(8,b'\x00'))
i32		=	lambda data					: int(io.recv(data), 16)
i64		=	lambda data					: int(io.recv(data), 16)
ioi     =   lambda                      : io.interactive()
#获取libc函数地址
def libc_func_addr(base,func):
    return base+libc.sym['func']
#简单的shellcode+orw
def shell():
    return asm(shellcraft.sh())
def orw(flag_file_name,addr,count):
    return asm(shellcraft.open(str(flag_file_name)) + shellcraft.read(3,addr,count) + shellcraft.write(1,addr,count))

#连接
#--------------------------------------------------------------------------------
ioi()

└─$ cd ~/glibc-all-in-one/debs
└─$ wget http://launchpadlibrarian.net/293727477/libc6_2.23-0ubuntu5_i386.deb
└─$ mkdir ~/glibc-all-in-one/libs/2.23-0ubuntu5_i386
└─$ cd ~/glibc-all-in-one/ 
└─$ ./extract debs/libc6_2.23-0ubuntu5_i386.deb libs/2.23-0ubuntu5_i386
└─$ cd ~/glibc-all-in-one/libs/2.23-0ubuntu5_i386

strings ./libc-x.xx | grep ubuntu    //查看版本
./download xxxx    //在glibc-all-in-one中下载相应版本
patchelf --set-interpreter 文件夹名/ld.so ./pwn    //换掉ld
patchelf --set-rpath 文件夹名 ./pwn    //换掉path