pee*_*pee -4 c buffer-overflow
我有以下功能.可执行文件运行正常.在提示符下,程序运行后,我输入\x0037337331,B的值设置为B: 0x31333337
关于我如何触发开放的任何建议 log.txt
int play() {
int a;
int b;
char buffer[010];
a = 0x41414141;
b = 0x42424242;
if (write(STDOUT_FILENO, "For a moment, nothing happened. Then, after a second or so, nothing continued to happen.\n> ", 91) < 0) {
perror("write");
}
if (read(STDIN_FILENO, &buffer, 0xC) < 0) {
perror("read");
}
if (a == 31337) {
system(buffer);
}
else if (b == 1337) {
readfile("log.txt");
}
else {
printf("B: 0x%08x\n", b);
}
}
Run Code Online (Sandbox Code Playgroud)
你有两个错误:
线:
char buffer[010]; // This is octal i.e. 8!
Run Code Online (Sandbox Code Playgroud)
应该
char buffer[0xc];
Run Code Online (Sandbox Code Playgroud)
也
read(STDIN_FILENO, &buffer, 0xC)
Run Code Online (Sandbox Code Playgroud)
应该
read(STDIN_FILENO, buffer, 0xC)
Run Code Online (Sandbox Code Playgroud)
因为你需要指向缓冲区开头的指针.
编辑
您还需要在之前将空字符添加到缓冲区system.