int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v4; // [rsp+3h] [rbp-3Dh]
  signed int i; // [rsp+4h] [rbp-3Ch]
  signed int j; // [rsp+4h] [rbp-3Ch]
  char *format; // [rsp+8h] [rbp-38h]
  _IO_FILE *fp; // [rsp+10h] [rbp-30h]
  char *v9; // [rsp+18h] [rbp-28h]
  char v10[24]; // [rsp+20h] [rbp-20h]
  unsigned __int64 v11; // [rsp+38h] [rbp-8h]

  v11 = __readfsqword(0x28u);
  fp = fopen("flag.txt", "r");
  for ( i = 0; i <= 21; ++i )
    v10[i] = _IO_getc(fp);
  fclose(fp);
  v9 = v10;
  puts("what's the flag");
  fflush(_bss_start);
  format = 0LL;
  __isoc99_scanf("%ms", &format);
  for ( j = 0; j <= 21; ++j )   #逐个做字符串对比，v10为flag 字符串
  {
    v4 = format[j];
    if ( !v4 || v10[j] != v4 )
    {
      puts("You answered:");
      printf(format);    <=============格式化字符串漏洞利用， 直接泄漏栈内存其实可以看到。
      puts("\nBut that was totally wrong lol get rekt");
      fflush(_bss_start);
      return 0;
    }
  }
  printf("That's right, the flag is %s\n", v9);
  fflush(_bss_start);
  return 0;
}

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  signed int v3; // eax
  int v4; // [esp+14h] [ebp-2Ch]
  int v5; // [esp+3Ch] [ebp-4h]

  setbuf(stdout, 0);
  ask_username((char *)&v4);  //账号   
  ask_password((char *)&v4);  //密码验证
  while ( 1 )
  {
    while ( 1 )
    {
      print_prompt();
      v3 = get_command();    //三个选择   get  put  dir
      v5 = v3;
      if ( v3 != 2 )         //put模式     实现了 大概的 漏洞功能
        break;
      put_file();            
    }
    if ( v3 == 3 )          //dir 模式     实现了大概的 目录遍历功能 
    {
      show_dir();
    }
    else
    {
      if ( v3 != 1 )        //get模式    
        exit(1);
      get_file();             // 这里 给出了明显的提示
    }
  }
}



int get_file()
{
  char dest; // [esp+1Ch] [ebp-FCh]
  char s1; // [esp+E4h] [ebp-34h]
  char *i; // [esp+10Ch] [ebp-Ch]

  printf("enter the file name you want to get:");
  __isoc99_scanf("%40s", &s1);
  if ( !strncmp(&s1, "flag", 4u) )     //  文件名为 flag
    puts("too young, too simple");
  for ( i = (char *)file_head; i; i = (char *)*((_DWORD *)i + 60) )  //从put里的数据中拿,借助文件来进行参数传递
  {
    if ( !strcmp(i, &s1) )
    {
      strcpy(&dest, i + 0x28);       //这个地方可以执行  格式化漏洞调试
      return printf(&dest);          
    }
  }
  return printf(&dest);              
}


int show_dir()
{
  int v0; // eax
  char s[1024]; // [esp+14h] [ebp-414h]
  int i; // [esp+414h] [ebp-14h]
  int j; // [esp+418h] [ebp-10h]
  int v5; // [esp+41Ch] [ebp-Ch]

  v5 = 0;
  j = 0;
  bzero(s, 0x400u);
  for ( i = file_head; i; i = *(_DWORD *)(i + 240) )
  {
    for ( j = 0; *(_BYTE *)(i + j); ++j )
    {
      v0 = v5++;
      s[v0] = *(_BYTE *)(i + j);
    }
  }
  return puts(s);       《=======  这个 地方的 put  可以在 当被替换的对象，同时会读取文件中得数据可以当做参数
}

char *__cdecl ask_username(char *dest)
{
  char src[40]; // [esp+14h] [ebp-34h]
  int i; // [esp+3Ch] [ebp-Ch]

  puts("Connected to ftp.hacker.server");
  puts("220 Serv-U FTP Server v6.4 for WinSock ready...");
  printf("Name (ftp.hacker.server:Rainism):");
  __isoc99_scanf("%40s", src);
  for ( i = 0; i <= 39 && src[i]; ++i )
    ++src[i];    //输入的字符都会加1
  return strcpy(dest, src);
}

int __cdecl ask_password(char *s1)
{
  if ( strcmp(s1, "sysbdmin") )    //输入的用户名 自加1 后 等于sysbdmin就可以了  rxraclhm
  {
    puts("who you are?");          
    exit(1);
  }
  return puts("welcome!");
}

//主函数
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  __int64 v3; // rdx
  __int64 v4; // rcx
  __int64 v5; // r8
  __int64 v6; // r9
  FILE *v7; // rdi
  __int64 v8; // rdx
  __int64 v9; // rcx
  __int64 v10; // r8
  __int64 v11; // r9
  __int64 buf; // [rsp+10h] [rbp-60h]
  __int64 v14; // [rsp+18h] [rbp-58h]
  __int64 v15; // [rsp+20h] [rbp-50h]
  __int64 v16; // [rsp+28h] [rbp-48h]
  __int64 v17; // [rsp+30h] [rbp-40h]
  __int64 v18; // [rsp+40h] [rbp-30h]
  __int64 v19; // [rsp+48h] [rbp-28h]
  char v20[20]; // [rsp+50h] [rbp-20h]
  int v21; // [rsp+64h] [rbp-Ch]

  v18 = 48LL;
  v19 = 0LL;
  *(_DWORD *)v20 = 0;
  *(_QWORD *)&v20[4] = 0x30LL;
  *(_QWORD *)&v20[12] = 0LL;
  v21 = 0;
  sub_4008BB();
  while ( 1 )
  {
    sub_400903(      //注册账号地址
      (__int64)&buf,
      (__int64)a2,
      v3,
      v4,
      v5,
      v6,
      v18,
      v19,
      *(__int64 *)v20,
      *(__int64 *)&v20[8],
      *(__int64 *)&v20[16]);
    if ( (_BYTE)buf != 48 )
      break;
    puts("Register failure,try again...");
    fflush(stdout);
  }
  puts("Register Success!!");
  v7 = stdout;
  fflush(stdout);
  sub_400D2B((__int64)v7, (__int64)a2, v8, v9, v10, v11, buf, v14, v15, v16, v17); 
  //循环选项，显示注册信息，更改注册信息，退出三个选项
  return 0LL;
}

//注册函数

__int64 __fastcall sub_400903(__int64 buf, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 bufa, __int64 a8, __int64 a9, __int64 a10, __int64 a11)
{
  unsigned __int8 v12; // [rsp+1Fh] [rbp-1h]

  puts("Register Account first!");
  puts("Input your username(max lenth:20): ");
  fflush(stdout);
  v12 = read(0, &bufa, 0x14uLL);    //注册名
  if ( v12 && v12 <= 0x14u )
  {
    puts("Input your password(max lenth:20): ");
    fflush(stdout);
    read(0, (char *)&a9 + 4, 20uLL);     //注册密码
    fflush(stdout);
    *(_QWORD *)buf = bufa;
    *(_QWORD *)(buf + 8) = a8;
    *(_QWORD *)(buf + 16) = a9;
    *(_QWORD *)(buf + 24) = a10;
    *(_QWORD *)(buf + 32) = a11;
  }
  else
  {
    LOBYTE(bufa) = 48;
    puts("error lenth(username)!try again");
    fflush(stdout);
    *(_QWORD *)buf = bufa;
    *(_QWORD *)(buf + 8) = a8;
    *(_QWORD *)(buf + 16) = a9;
    *(_QWORD *)(buf + 24) = a10;
    *(_QWORD *)(buf + 32) = a11;
  }
  return buf;
}

//选择函数
int __fastcall sub_400D2B(__int64 s, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 sa, __int64 a8, __int64 a9, __int64 a10, __int64 a11)
{
  char v11; // di
  int v12; // eax
  __int64 v13; // rdx
  __int64 v14; // rcx
  __int64 v15; // r8
  __int64 v16; // r9

  v11 = (char)stdin;
  setbuf(stdin, 0LL);
  while ( 1 )
  {
    v12 = sub_400A75();
    switch ( v12 )
    {
      case 2:
        sub_400B41((__int64)&sa, 0LL, v13, v14, v15, v16, sa, a8, a9, a10, a11);//修改
        break;
      case 3:
        return sub_400D1A();//退出
      case 1:
        sub_400B07(v11, 0LL, v13, v14, v15, v16, sa, a8, a9);//显示
        break;
      default:
        puts("error options");
        fflush(stdout);
        break;
    }
    v11 = (char)stdout;
    fflush(stdout);
  }
}
//显示信息函数
int __fastcall sub_400B07(char format, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, char formata, __int64 a8, __int64 a9)
{
  write(0, "Welc0me to sangebaimao!\n", 0x1AuLL);
  printf(&formata, "Welc0me to sangebaimao!\n");
  return printf((const char *)&a9 + 4);   //明显的字符串调用讨论，参数和password名称一致
}

int __cdecl main()
{
  int v1; // [esp+18h] [ebp-8h]
  int i; // [esp+1Ch] [ebp-4h]

  setvbuf(stdout, 0, 2, 0);
  for ( i = 0; i <= 9; ++i )
    memset((void *)(80 * i + 0x804B0A0), 0, 0x50u);
LABEL_11:
  while ( v1 != 5 )
  {
    printf("%s", menu);
    __isoc99_scanf("%u%*c", &v1);
    switch ( v1 )
    {
      case 1:
        CreatContact(people);    //创建账户
        break;
      case 2:                    //删除账户
        RemoveContact(people);
        break;
      case 3:
        ChangeName(people);      //更改名称
        break;
      case 4:
        PrintContact(people);    //打印信息
        break;
      case 5:
        goto LABEL_11;
      default:
        puts("Invalid option");
        break;
    }
  }
  puts("Thanks for trying out the demo, sadly your contacts are now erased");
  return 0;
}

逐个进行查看，发现比较明显的地方是


打印信息处
PrintInfo 函数


int __cdecl PrintInfo(int a1, int a2, int a3, char *format)
{
  printf("\tName: %s\n", a1);
  printf("\tLength %u\n", a2);
  printf("\tPhone #: %s\n", a3);
  printf("\tDescription: ");
  return printf(format);    《---比较明显的格式化字符串漏洞
}

向上追溯 format 这个参数，

 result = PrintInfo((int)v2->name, v2->des_len, (int)v2->phone, v2->description);
为 description  的信息

追溯到 des 的读入地址发现

char *__cdecl ReadDescription(contact *a1)
{
  char *result; // eax
  int v2; // [esp+1Ch] [ebp-Ch]

  printf("\tLength of description: ");
  __isoc99_scanf("%u%*c", &v2);
  a1->des_len = v2;
  a1->description = (char *)malloc(v2 + 1);     《------信息主要在堆上
  if ( !a1->description )
    exit(1);
  printf("\tEnter description:\n\t\t");
  fgets(a1->description, v2 + 1, stdin);
  result = a1->description;
  if ( !a1->description )
    exit(1);
  return result;
}

 dereference $esp l140
0xffffd010│+0x0000: 0x0804c420  →  0x00000000	 ← $esp
0xffffd014│+0x0004: 0x0804c410  →  "111111111"
0xffffd018│+0x0008: 0xf7e6714b  →  <puts+11> add ebx, 0x150eb5
0xffffd01c│+0x000c: 0x00000000
0xffffd020│+0x0010: 0xf7fb8000  →  0x001afdb0
0xffffd024│+0x0014: 0xf7fb8000  →  0x001afdb0
0xffffd028│+0x0018: 0xffffd058  →  0xffffd088  →  0x00000000	 ← $ebp
0xffffd02c│+0x001c: 0x08048c99  →   add DWORD PTR [ebp-0xc], 0x1
0xffffd030│+0x0020: 0x0804b0a8  →  "dccgcccg"
0xffffd034│+0x0024: 0x00000000
0xffffd038│+0x0028: 0x0804c410  →  "111111111"
0xffffd03c│+0x002c: 0x0804c420  →  0x00000000
0xffffd040│+0x0030: 0xf7fb8d60  →  0xfbad2887
0xffffd044│+0x0034: 0x08048ed6  →  0x25007325 ("%s"?)
0xffffd048│+0x0038: 0x0804b0a0  →  0x0804c420  →  0x00000000
0xffffd04c│+0x003c: 0x00000000
0xffffd050│+0x0040: 0xf7fb8000  →  0x001afdb0
0xffffd054│+0x0044: 0x00000000
0xffffd058│+0x0048: 0xffffd088  →  0x00000000
0xffffd05c│+0x004c: 0x080487a2  →   jmp 0x80487b3
0xffffd060│+0x0050: 0x0804b0a0  →  0x0804c420  →  0x00000000
0xffffd064│+0x0054: 0xffffd078  →  0x00000004
0xffffd068│+0x0058: 0x00000050 ("P"?)
0xffffd06c│+0x005c: 0x00000000
0xffffd070│+0x0060: 0xf7fb83dc  →  0xf7fb91e0  →  0x00000000
0xffffd074│+0x0064: 0x08048288  →   (bad) 
0xffffd078│+0x0068: 0x00000004
0xffffd07c│+0x006c: 0x0000000a
0xffffd080│+0x0070: 0xf7fb8000  →  0x001afdb0
0xffffd084│+0x0074: 0xf7fb8000  →  0x001afdb0
0xffffd088│+0x0078: 0x00000000
0xffffd08c│+0x007c: 0xf7e20637  →  <__libc_start_main+247> add esp, 0x10 <-- 偏移31
0xffffd090│+0x0080: 0x00000001
0xffffd094│+0x0084: 0xffffd124  →  0xffffd2fe  →  "/home/toor/Desktop/contacts"
0xffffd098│+0x0088: 0xffffd12c  →  0xffffd31a  →  "XDG_VTNR=7"
0xffffd09c│+0x008c: 0x00000000
0xffffd0a0│+0x0090: 0x00000000
0xffffd0a4│+0x0094: 0x00000000
0xffffd0a8│+0x0098: 0xf7fb8000  →  0x001afdb0
0xffffd0ac│+0x009c: 0xf7ffdc04  →  0x00000000
0xffffd0b0│+0x00a0: 0xf7ffd000  →  0x00022f3c
0xffffd0b4│+0x00a4: 0x00000000
0xffffd0b8│+0x00a8: 0xf7fb8000  →  0x001afdb0
0xffffd0bc│+0x00ac: 0xf7fb8000  →  0x001afdb0
0xffffd0c0│+0x00b0: 0x00000000
0xffffd0c4│+0x00b4: 0x6566a302
0xffffd0c8│+0x00b8: 0x5ecc6d12
0xffffd0cc│+0x00bc: 0x00000000
0xffffd0d0│+0x00c0: 0x00000000
0xffffd0d4│+0x00c4: 0x00000000
0xffffd0d8│+0x00c8: 0x00000001
0xffffd0dc│+0x00cc: 0x080485c0  →   xor ebp, ebp
0xffffd0e0│+0x00d0: 0x00000000
0xffffd0e4│+0x00d4: 0xf7feeff0  →   pop edx
0xffffd0e8│+0x00d8: 0xf7fe9880  →   push ebp
0xffffd0ec│+0x00dc: 0xf7ffd000  →  0x00022f3c
0xffffd0f0│+0x00e0: 0x00000001
0xffffd0f4│+0x00e4: 0x080485c0  →   xor ebp, ebp


偏移计算
fmtarg 0xffffd08c
The index of format argument : 31
gef➤  fmtarg 0xffffd03c
The index of format argument : 11    格式化字符串地址
fmtarg 0xffffd028
The index of format argument : 6     存上层ebp地址