test your nc

查看文件保护

root@localhost ~# checksec test
[*] '/root/test'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled

流程分析

尝试直接运行

root@localhost ~# ./test
sh-4.2# whoami
root

可以看到直接就获得了shell,直接nc连接获得flag

exp

root@localhost ~# nc node4.buuoj.cn 29403
cat flag
flag{7730b1f6-6dbe-49f0-b4ca-4902ec2552c3}