Buuctf-- happy New Year

1. Preprocessing

Get information
1.upx shell
2.32 Bit file

2. Shelling （ It can be used Shelling tools Shelling , It can also be shelled manually ）
Method 1 ： Shelling with tools
Method 2 ： Manual shelling
Not yet , Learning

3. Reexamine
Check to see if the shell has been removed

Chou Chou , There is no shell , And then put in IDA(32), use shift+F12 Find string ,
You can actually use F5 Go directly to the main function , Pseudocode found ,
But I personally like to look for the string first ,
After all , The final flag Is it usually a string ！

So first shift+F12 Take a look at , See if there's any clue

then , double-click ’ this is true flag!' Disassembly 、F5 Decompile found pseudo code

4. The code analysis

sub_401910();
qmemcpy(&v1, “HappyNewYear!”, 0xEu);
*(_WORD *)Str1 = 0;
memset(&v3, 0, 0x1Eu);
printf(“please input the true flag:”);
scanf("%s", Str1);
if ( !strncmp(Str1, &v1, strlen(&v1)) )
result = puts(“this is true flag!”);
else
result = puts(“wrong!”);
return result;

This main function is relatively simple ,
Just used it. memcpy、memset、strncmp Three functions
flag Obviously flag{HappyNewYear!}