Okay so we have a bof, can we get it to redirect IP (instruction pointer) to something else?
If you get stuck liveoverflow covers you again!
nc thekidofarcrania.com 4902
Discussion
Very practical for a beginner, THANKS. #hint: replace the 'return address' with the 'win()' function address. (you can find it using any debugger as 'gdb' is), then using python2 to inject it (or overflow it) into the binary. (Ensure the address is in 'raw binary' value !).
Basically it is similar to RET2WIN attack as we have to overwrite the return address with the address of win function...hence we'll get the flag :)
GOOD
CTFlearn{c0ntr0ling_r1p_1s_n0t_t00_h4rd_abjkdlfa}
Took me an entire day! I was looking ebx which I correctly overrided with the win address. That's not the crux of solving this and I wasted time wondering why. After almost a day, it dawned on me to also look at the buff visualisation and realised I haven't overflowed enough to reach the return address. And last but not least, I was wondering why gdb run told me that flag.txt was not found and then realised I need to redurect my python exploit file into the server version because the flag file is on the server, not locally.
why the hell would python3 print c2's ,what are this c2's
Very practical for a beginner, THANKS. #hint: replace the 'return address' with the 'win()' function address. (you can find it using any debugger as 'gdb' is), then using python2 to inject it (or overflow it) into the binary. (Ensure the address is in 'raw binary' value !).
2 weeks ago