• to be continued…

PART I

unpack

  • allinone.sh

run.sh

1
2
3
4
5
6
7
8
9
10
11
12
13
#!/bin/sh

qemu-system-x86_64 \
        -m 512M \
        -cpu qemu64,+smep,+smap -smp 2 \
        -kernel bzImage \
        -append "console=ttyS0 quiet panic=-1 nokaslr" \
        -initrd rootfs.cpio \
        -drive file=./flag,if=virtio,format=raw,readonly=on \
        -nographic \
        -net nic,model=e1000 \
        -no-reboot \
        -monitor /dev/null

runable

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
#!/bin/sh

qemu-system-x86_64 \
        -m 512M \
        -cpu qemu64,+smep,+smap \
        -smp 2 \
        -kernel bzImage \
        -append "console=ttyS0 quiet panic=0 nokaslr" \
        -initrd rootfs.cpio \
        -drive file=./flag,if=virtio,format=raw,readonly=on \
        -nographic \
        -net nic,model=e1000 \
        -no-reboot \
        -monitor /dev/null \
        -s

-drive file=./flag,if=virtio,format=raw,readonly=on \要求在启动run.sh的目录下存放一个flag文件

1
2
#       -chardev stdio,id=char0,signal=off \
#       -serial chardev:char0 \

加上这两行可以直接将qemu中的ctrl+cban掉，但用起来很不舒服

init

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
#!/bin/sh

mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs tmpfs /tmp
mount -t devtmpfs none /dev

echo -e "\nBoot took $(cut -d' ' -f1 /proc/uptime) seconds\n"

chmod 600 /flag

ifconfig eth0 10.0.2.15
route add default gw 10.0.2.2

su ctf -c /bin/bash

poweroff -f
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
#!/bin/sh

mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs tmpfs /tmp
mount -t devtmpfs none /dev

echo -e "\nBoot took $(cut -d' ' -f1 /proc/uptime) seconds\n"

chmod 600 /flag

ifconfig eth0 10.0.2.15
route add default gw 10.0.2.2

su root -c /bin/bash

poweroff -f

su是用来切换用户的

  • -c 表示执行一条命令

PART II

PRAT III

op

  • gdb -x ./gdb.sh