axb_2019_fmt32 wp

---

title: axb_2019_fmt32 wp
date: 2021-6-8 22:00:00
tags:

• write up
• format string
  comments: true
  categories:
• ctf
• pwn

---

临近期末考试了，终于可以光明正大地水博客了。

最近刚写上格式化字符串的漏洞，这不，他来了。这个题目我做过之后感觉难度还是有的，做出这一题至少对格式化字符串漏洞的利用是有一个较深的理解了的。它综合考察了ret2libc和格式化字符串的任意写，以及对got表的理解。

axb_2019_fmt32

下载文件，反汇编打开，再反编译main函数得到如下代码

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
   
  char s[257]; // [esp+Fh] [ebp-239h] BYREF
  char format[300]; // [esp+110h] [ebp-138h] BYREF
  unsigned int v5; // [esp+23Ch] [ebp-Ch]

  v5 = __readgsdword(0x14u);
  setbuf(stdout, 0);
  setbuf(stdin, 0);
  setbuf(stderr, 0);
  puts(
    "Hello,I am a computer Repeater updated.\n"
    "After a lot of machine learning,I know that the essence of man is a reread machine!");
  puts("So I'll answer whatever you say!");
  while ( 1 )
  {
   
    alarm(3u);
    memset(s, 0, sizeof(s));
    memset(format, 0, sizeof(format));