StarCTF 栈溢出 Level5.0-Oneshot

程序代码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
unsigned int stackoverflow()
{
  char v0; // ST04_1
  char s; // [esp+Ch] [ebp-4Ch]
  int v3; // [esp+2Ch] [ebp-2Ch]
  unsigned int v4; // [esp+4Ch] [ebp-Ch]

  v4 = __readgsdword(0x14u);
  memset(&s, 0, 0x40u);
  ((void (__cdecl *)(const char *, char))printf)("What's your name?", v0);
  get_line(&v3);
  printf("%s,let's make stackoverflow great again!\n", (unsigned int)&v3);
  get_line(&s);
  return __readgsdword(0x14u) ^ v4;
}
unsigned int __cdecl get_line(int a1)
{
  char v2; // [esp+17h] [ebp-11h]
  int v3; // [esp+18h] [ebp-10h]
  unsigned int v4; // [esp+1Ch] [ebp-Ch]

  v4 = __readgsdword(0x14u);
  v3 = 0;
  while ( read(0, (int)&v2, 1) > 0 && v2 != 0xA )
    *(_BYTE *)(a1 + v3++) = v2;
  return __readgsdword(0x14u) ^ v4;
}

思路:get_line肯定是有溢出的,通过第一次溢出来读取到canary,用第二次来ROP。

0%