Skip to content

Latest commit

 

History

History
54 lines (43 loc) · 1.18 KB

README.md

File metadata and controls

54 lines (43 loc) · 1.18 KB

Pwn sanity check

Basic Bufferoverflow in the vuln() function

int vuln()
{
  char s[60]; // [rsp+0h] [rbp-40h] BYREF
  int v2; // [rsp+3Ch] [rbp-4h]

  puts("tell me a joke");
  fgets(s, 256, stdin);
  if ( v2 != 0xDEADC0DE )
    return puts("will this work?");
  puts("very good, here is a shell for you. ");
  return shell();
}

and there is a win() function in this program

int __fastcall win(int a1, int a2)
{
  int result; // eax

  result = puts("you made it to win land, no free handouts this time, try harder");
  if ( a1 == 0xDEADBEEF )
  {
    result = puts("one down, one to go!");
    if ( a2 == 0x1337C0DE )
    {
      puts("2/2 bro good job");
      system("/bin/sh");
      exit(0);
    }
  }
  return result;
}

Welp i solve this without following the conditions in win function. Just need jump to system('/bin/sh')

.text:00000000004006DB                 lea     rdi, command    ; "/bin/sh" << jump to here
.text:00000000004006E2                 call    _system

dont forget to add some ret for bypass the allignment

Full Sript

Flag