攻防世界GFSJ1012 pwnstack

题目编号：GFSJ1012

附件下载后是一个c和库文件：

获取在线场景是

1. 获取伪代码

Exeinfo打开pwn2，分析如图，64位。

IDA Pro(64-bit)打开pwn2，生成伪代码

2. 分析代码漏洞

/* This file was generated by the Hex-Rays decompiler version 8.3.0.230608.
   Copyright (c) 2007-2021 Hex-Rays <[email protected]>

   Detected compiler: GNU C++
*/

#include <defs.h>


//-------------------------------------------------------------------------
// Function declarations

void *init_proc();
__int64 sub_400550(); // weak
// int puts(const char *s);
// int system(const char *command);
// ssize_t read(int fd, void *buf, size_t nbytes);
// int __fastcall __libc_start_main(int (__fastcall *main)(int, char **, char **), int argc, char **ubp_av, void (*init)(void), void (*fini)(void), void (*rtld_fini)(void), void *stack_end);
// int setvbuf(FILE *stream, char *buf, int modes, size_t n);
// __int64 _gmon_start__(void); weak
void __fastcall __noreturn start(__int64 a1, __int64 a2, void (*a3)(void));
signed __int64 deregister_tm_clones();
__int64 register_tm_clones(void); // weak
signed __int64 _do_global_dtors_aux();
__int64 __fastcall frame_dummy(_QWORD, _QWORD, _QWORD); // weak
__int64 __fastcall initsetbuf(_QWORD, _QWORD, _QWORD); // weak
__int64 vuln(void); // weak
int backdoor();
int __fastcall main(int argc, const char **argv, const char **envp);
void _libc_csu_fini(void); // idb
void term_proc();

//-------------------------------------------------------------------------
// Data declarations

_UNKNOWN _libc_csu_init;
__int64 (__fastcall *_frame_dummy_init_array_entry[2])() = { &frame_dummy, &_do_global_dtors_aux }; // weak
__int64 (__fastcall *_do_global_dtors_aux_fini_array_entry)() = &_do_global_dtors_aux; // weak
__int64 (*qword_601010)(void) = NULL; // weak
_UNKNOWN _bss_start; // weak
_UNKNOWN unk_601057; // weak
FILE *stdout; // idb
FILE *stdin; // idb
FILE *stderr; // idb
char completed_7594; // weak
// extern _UNKNOWN __gmon_start__; weak


//----- (0000000000400530) ----------------------------------------------------
void *init_proc()
{
  void *result; // rax

  result = &__gmon_start__;
  if ( &__gmon_start__ )
    return (void *)_gmon_start__();
  return result;
}
// 4005B0: using guessed type __int64 _gmon_start__(void);

//----- (0000000000400550) ----------------------------------------------------
__int64 sub_400550()
{
  return qword_601010();
}
// 400550: using guessed type __int64 sub_400550();
// 601010: using guessed type __int64 (*qword_601010)(void);

//----- (00000000004005C0) ----------------------------------------------------
// positive sp value has been detected, the output may be w