search

there_sir

Looking at vuln() decompiled:

void vuln(void)

{
  undefined buffer [64];
  
  printf("Enter something: ");
  read(0,hurm,16);
  printf("Enter message: ");
  read(0,buffer,1024);
  return;
}

We can see a clear Overflow here:

There is also a win() function:

We are required to pass in two arguments, 1337 and /bin/sh . But the catch here is that the 2'nd argument is pointer not an integer like 1'st argument. The solution is we need to use the read() syscall which has a PLT entry to read /bin/sh at a specific address.

Using rabin2 we can see which section we want to tell read() to look at, in this case I will choose .bss section because it has a lot of space and has RW permissions.

read() takes in 3 arguments:

The file descriptor will be 0 (Read from stdin ). Other than that we need to make sure it has enough gadgets to pass in 3 arguments.

Perfect, we have the RDI, RSI and RDX gadgets. Now we can build the script

hashtag
Manual Script

After sending the payload, only then we send the /bin/sh string when read() is invoked, waiting input from stdin . This writes the string to that address.

hashtag
Auto Script

We can also do a ROP chain to automatically write the string to that address without manually finding the gadgets, as the ROP function will do that for us

Previoussmoll but spookyNextMobile

Last updated