XCTF_ACTF_2025

ACTF_2025

checksec：

briteny@localhost:/mnt/d/copy/ACTF_read/deploy$ checksec only_read
[*] '/mnt/d/copy/ACTF_read/deploy/only_read'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No

IDA_Pro:

main:

int __fastcall main(int argc, const char **argv, const char **envp)
{
  char buf[128]; // [rsp+0h] [rbp-80h] BYREF

  read(0, buf, 0x800uLL);
  return 0;
}

很明显的栈溢出漏洞，然后就根据该漏洞构造。

objdump:

plt表只存在read函数，且我们可以修改read函数的返回地址来重启程序(函数)

Disassembly of section .plt.sec:

0000000000401040 <read@plt>:
  401040:       f3 0f 1e fa             endbr64
  401044:       ff 25 b6 2f 00 00       jmp    QWORD PTR [rip+0x2fb6]        # 404000 <read@GLIBC_2.2.5>
  40104a:       66 0f 1f 44 00 00       nop    WORD PTR [rax+rax*1+0x0]