https://3133q.github.io/tags/%E8%84%9A%E6%9C%AC%E5%B7%A5%E5%85%B7/Recent content in 脚本工具 on Vortex's BlogHugo -- gohugo.iozh-cnThu, 13 Aug 2026 20:46:54 +0800https://3133q.github.io/p/pwn-script-template/Thu, 13 Aug 2026 20:46:54 +0800https://3133q.github.io/p/pwn-script-template/<img src="https://3133q.github.io/covers/07.jpg" alt="Featured image of post 脚本模板" /><h2 id="完整脚本模板">完整脚本模板 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span><span class="lnt">13 </span><span class="lnt">14 </span><span class="lnt">15 </span><span class="lnt">16 </span><span class="lnt">17 </span><span class="lnt">18 </span><span class="lnt">19 </span><span class="lnt">20 </span><span class="lnt">21 </span><span class="lnt">22 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="kn">from</span> <span class="nn">pwn</span> <span class="kn">import</span> <span class="o">*</span> </span></span><span class="line"><span class="cl"><span class="n">context</span><span class="o">.</span><span class="n">arch</span><span class="o">=</span><span class="s2">&#34;amd64&#34;</span> <span class="c1"># amd64(64位) i386(32位)</span> </span></span><span class="line"><span class="cl"><span class="n">context</span><span class="o">.</span><span class="n">os</span><span class="o">=</span><span class="s2">&#34;linux&#34;</span> </span></span><span class="line"><span class="cl"><span class="n">context</span><span class="o">.</span><span class="n">log_level</span><span class="o">=</span><span class="s2">&#34;debug&#34;</span> <span class="c1">#开启 debug 模式</span> </span></span><span class="line"><span class="cl"><span class="n">elf</span><span class="o">=</span><span class="n">ELF</span><span class="p">(</span><span class="s2">&#34;./lottery_debug&#34;</span><span class="p">)</span> </span></span><span class="line"><span class="cl"><span class="n">libc</span><span class="o">=</span><span class="n">ELF</span><span class="p">(</span><span class="s2">&#34;./libc.so.6&#34;</span><span class="p">)</span> <span class="c1">#如果有</span> </span></span><span class="line"><span class="cl"><span class="k">def</span> <span class="nf">conn</span><span class="p">():</span> </span></span><span class="line"><span class="cl"> <span class="k">if</span> <span class="n">args</span><span class="o">.</span><span class="n">REMOTE</span><span class="p">:</span> </span></span><span class="line"><span class="cl"> <span class="n">host</span><span class="o">=</span><span class="s2">&#34;&#34;</span> </span></span><span class="line"><span class="cl"> <span class="n">port</span><span class="o">=</span> </span></span><span class="line"><span class="cl"> <span class="k">return</span> <span class="n">remote</span><span class="p">(</span><span class="n">host</span><span class="p">,</span><span class="n">port</span><span class="p">)</span> </span></span><span class="line"><span class="cl"> <span class="k">else</span><span class="p">:</span> </span></span><span class="line"><span class="cl"> <span class="k">return</span> <span class="n">process</span><span class="p">(</span><span class="s2">&#34;&#34;</span><span class="p">)</span> </span></span><span class="line"><span class="cl"><span class="k">def</span> <span class="nf">exploit</span><span class="p">(</span><span class="n">io</span><span class="p">):</span> </span></span><span class="line"><span class="cl"> <span class="n">io</span><span class="o">.</span><span class="n">recvuntil</span><span class="p">(</span><span class="sa">b</span><span class="s2">&#34;&#34;</span><span class="p">)</span> </span></span><span class="line"><span class="cl"> <span class="n">line</span><span class="o">=</span><span class="n">io</span><span class="o">.</span><span class="n">recvline</span><span class="p">()</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span><span class="o">.</span><span class="n">split</span><span class="p">()</span> </span></span><span class="line"><span class="cl"> <span class="n">payload</span><span class="o">=</span> </span></span><span class="line"><span class="cl"> <span class="n">io</span><span class="o">.</span><span class="n">sendline</span><span class="p">(</span><span class="n">payload</span><span class="p">)</span> </span></span><span class="line"><span class="cl"> <span class="n">io</span><span class="o">.</span><span class="n">interactive</span><span class="p">()</span> </span></span><span class="line"><span class="cl"><span class="k">if</span> <span class="vm">__name__</span><span class="o">==</span><span class="s1">&#39;__main__&#39;</span><span class="p">:</span> </span></span><span class="line"><span class="cl"> <span class="n">io</span><span class="o">=</span><span class="n">conn</span><span class="p">()</span> </span></span><span class="line"><span class="cl"> <span class="n">exploit</span><span class="p">(</span><span class="n">io</span><span class="p">)</span> </span></span></code></pre></td></tr></table> </div> </div>https://3133q.github.io/p/pwn-remote-connect/Thu, 13 Aug 2026 20:46:19 +0800https://3133q.github.io/p/pwn-remote-connect/<img src="https://3133q.github.io/covers/04.jpg" alt="Featured image of post 连接远端" /><p><strong>1. 添加端口转发规则：</strong></p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="n">netsh</span> <span class="n">interface</span> <span class="n">portproxy</span> <span class="n">add</span> <span class="n">v4tov4</span> <span class="n">listenport</span><span class="o">=</span><span class="mi">54854</span> <span class="n">listenaddress</span><span class="o">=</span><span class="mf">0.0.0.0</span> <span class="n">connectport</span><span class="o">=</span><span class="mi">54854</span> <span class="n">connectaddress</span><span class="o">=</span><span class="mf">127.0.0.1</span> </span></span></code></pre></td></tr></table> </div> </div><p><strong>2. 添加入站防火墙规则（防止被 Windows 防火墙拦截）：</strong></p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="n">netsh</span> <span class="n">advfirewall</span> <span class="n">firewall</span> <span class="n">add</span> <span class="n">rule</span> <span class="n">name</span><span class="o">=</span><span class="s2">&#34;CTF-WSRX-54854&#34;</span> <span class="nb">dir</span><span class="o">=</span><span class="ow">in</span> <span class="n">action</span><span class="o">=</span><span class="n">allow</span> <span class="n">protocol</span><span class="o">=</span><span class="n">TCP</span> <span class="n">localport</span><span class="o">=</span><span class="mi">54854</span> </span></span></code></pre></td></tr></table> </div> </div><p>pwninit 修复文件</p> <hr> <p><em>以上内容如有理解不到位或表述不当的地方，还请各位师傅不吝赐教。</em></p>