pwntools是一个ctf框架和漏洞利用开发库,用Python开发,由rapid设计,旨在让使用者简单快速的编写exploit。
pwntools对Ubuntu 12.04和14.04的支持最好,但是绝大多数的功能也支持Debian, Arch, FreeBSD, OSX, 等等,确保安装以下系统库。
Ubuntu
Mac OS X
Alternate OSes
Ubuntu
Mac OS X
Ubuntu
Mac OS X
Default
$ apt-get install python2.7 python2.7-dev python-pip $ pip install pwntools
Default
$ git clone https://github.com/Gallopsled/pwntools $ cd pwntools $ pip install -e .
Default
pwnlib.asm — Assembler functions pwnlib.atexception — Callbacks on unhandled exception pwnlib.atexit — Replacement for atexit pwnlib.constants — Easy access to header file constants pwnlib.context — Setting runtime variables pwnlib.dynelf — Resolving remote functions using leaks pwnlib.elf — Working with ELF binaries pwnlib.exception — Pwnlib exceptions pwnlib.gdb — Working with GDB pwnlib.log and — Logging stuff pwnlib.memleak — Helper class for leaking memory pwnlib.replacements — Replacements for various functions pwnlib.rop — Return Oriented Programming pwnlib.shellcraft — Shellcode generation pwnlib.term — Terminal handling pwnlib.timeout — Timeout handling pwnlib.tubes — Talking to the World! pwnlib.ui — Functions for user interaction pwnlib.useragents — A database of useragent strings pwnlib.util.crc — Calculating CRC-sums pwnlib.util.cyclic — Generation of unique sequences pwnlib.util.fiddling — Utilities bit fiddling pwnlib.util.hashes — Hashing functions pwnlib.util.iters — Extension of standard module itertools pwnlib.util.lists — Operations on lists pwnlib.util.misc — We could not fit it any other place pwnlib.util.net — Networking interfaces pwnlib.util.packing — Packing and unpacking of strings pwnlib.util.proc — Working with /proc/ pwnlib.util.safeeval — Safe evaluation of python code pwnlib.util.web — Utilities for working with the WWW
Default
context.log_level = 'debug'
支持常见操作recvline, recvuntil, clean 可以通过.interactive()直接与程序交互
前者将数字转化为字符串,后者反之
输出消息
Default
log.info('Hello, world!') p = log.progress('Working') p.status('Reticulating splines') time.sleep(1) p.success('Got a shell!')
Default
cyclic(20) cyclic_find('aafb')
Default
asm('mov eax, 0') asm(shellcraft.sh()) disasm('/xb8/x0b/x00/x00/x00')
Default
elf = ELF('pwn') hex(elf.address) hex(elf.symbols['write']) hex(elf.got['write']) hex(elf.plt['write'])
1 可以没有程序
Default
p = process('./pwnme') def leak(address): data = p.read(address, 4) return data main = 0xfeedf4ce d = DynELF(leak, main) d.lookup('system', 'libc') 2 如果有程序,速度会更快 d = DynELF(leak, main, elf=ELF('./pwnme'))
1 用gdb启动程序,并弹出新窗口与其交互2 附加到一个程序上,pid/pwnlibs.tubes/socket都可以
Default
python foo.py REMOTE=1 args['REMOTE'] == '1'
Default
b64d('dGVzdA==') b64e("test") bits(511, zero = "+", one = "-") 把参数转换为位 bits_str(511) 得到'0000000111111111' enhex("test") 得到'74657374' isprint(c) 判断一个字符是否可打印 randoms(10) 返回'evafjilupm' rol('abcdefg', 2) 得到'cdefgab' unhex("74657374") 得到'test' urldecode("test%20%41") urlencode
14 net 查询网络借口
15 proc 查询进程
16 pause
17 safeeval 执行python代码,但不会产生副作用
18 其他
Default
hexdump read and write enhex and unhex more group align and align_down urlencode and urldecode which wget
————————————–与pwnlib.tubes的常见交互方式
Default
recv() recvuntil() recvline()读取到'/n' recvlines(n) recvall() 读取到EOF send() sendline()会自动加换行符
——————————-
Default
>>> 'b800000000'.decode('hex') '/xb8/x00/x00/x00/x00' >>> '/xb8/x00/x00/x00/x00'.encode('hex') 'b800000000'
【via@91ri团队-君莫笑】