PWNABLE_01
作者:互联网
PWNABLE_01
pwnable是个很不错的pwn的学习网站,刷题,尽量不要翻看答案。
缺陷代码如下:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char buf[32];
int main(int argc, char* argv[], char* envp[]){
if(argc<2){
printf("pass argv[1] a number\n");
return 0;
}
int fd = atoi( argv[1] ) - 0x1234;
int len = 0;
len = read(fd, buf, 32);
if(!strcmp("LETMEWIN\n", buf)){
printf("good job :)\n");
system("/bin/cat flag");
exit(0);
}
printf("learn about Linux file IO\n");
return 0;
}
- hint: linux file description
- guest用户无flag文件执行权限,代码中如果
(!strcmp("LETMEWIN\n", buf)
执行成功会输出flag结果。 - 需要令buf的内容为LETMEWIN
len=read(fd,buf,32)
这句从fd指向的文件里读32字节的数据放入buf中- Linux的IO接口中,fd=0为标准输入,fd=1为标准输出,fd=2为错误输出。这里思路令fd=0,而后输入LETMEWIN
int fd = atoi( argv[1] ) - 0x1234;
所以第一个输入参数设置为4660- 最终执行,结果如下:
fd@pwnable:~$ ./fd 4660
LETMEWIN
good job :)
mommy! I think I know what a file descriptor is!!
flag{mommy! I think I know what a file descriptor is!!}
标签:01,int,32,PWNABLE,argv,fd,file,buf 来源: https://blog.csdn.net/Hkkkkkkkkk/article/details/111152118