HugeH4rD

chall

Ubuntu16

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/EasyPwn/chall'
    Arch:     i386-32-little
    RELRO:    Full RELRO
    Stack:    No canary found
    NX:       NX enabled			//栈不可执行
    PIE:      No PIE (0x8048000)

IDA

vuln()

int vuln()
{
  char s[18]; // [esp+6h] [ebp-12h] BYREF

  readn(s);				//s
  return readn(&str);	//.bss 0x804A040
}

readn()

int __cdecl readn(void *s)
{
  int v1; // eax
  int n; // [esp+8h] [ebp-10h]
  char v4; // [esp+Fh] [ebp-9h]

  v4 = getchar();
  n = 0;
  while ( v4 != 10 )
  {
    v1 = n++;
    *((_BYTE *)s + v1) = v4;
    v4 = getchar();
  }
  if ( n > 100 )
    memset(s, 0, n);
  return n;
}

0x02

---

思路