SCTF2021_Pwn_dataleak_WP

SCTF2021_dataleak_WP

检查文件和保护

64位小端序，动态链接。relro半开，没开canary，开了PIE和NX。

ida查看ELF文件cJSON_PWN

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
   
  int i; // [rsp+Ch] [rbp-54h]
  __int64 buf[2]; // [rsp+10h] [rbp-50h] BYREF
  __int64 v5[2]; // [rsp+20h] [rbp-40h] BYREF
  char v6[40]; // [rsp+30h] [rbp-30h] BYREF
  unsigned __int64 v7; // [rsp+58h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  for ( i = 0; i <= 1; ++i )
  {
   
    strcpy(v6, "this_is_data_in_server");
    v6[24] = 0;
    buf[0] = 0LL;
    buf[1] = 0LL;
    v5[0] = 0LL;
    v5[1] = 0LL;
    read(0