RIP my bof
30 points Easy

Okay so we have a bof, can we get it to redirect IP (instruction pointer) to something else?

If you get stuck liveoverflow covers you again!

nc thekidofarcrania.com 4902

simple-rip.tar.gz
Flag
Rating 4.81
5
4
3
2
1

Discussion

CTFlearn{c0ntr0ling_r1p_1s_n0t_t00_h4rd_abjkdlfa}

-3

have some guides?

0

goodthings

0

really suitable for a newer!

0

broo.. i couldn.t paste the sting which has the address it magically includes a c2 how to do it..

EDITED AFTER COMPLETION: learned few new things.. good challenge took 2 days

0
Protected
0

Thank you so fucking much for the visuals. I like Python3, but if I wasn't able to see the 'c2' there, I'd be bummed for so long!!! Also how can I figure out (without the visuals) that there is a 12 byte gap between the padding and win?

0
Protected
0

thanks, python3.... python2 is the way to go

1

Thanks for this very nice challenge! I learned a lot!

0

Took me an entire day! I was looking ebx which I correctly overrided with the win address. That's not the crux of solving this and I wasted time wondering why. After almost a day, it dawned on me to also look at the buff visualisation and realised I haven't overflowed enough to reach the return address. And last but not least, I was wondering why gdb run told me that flag.txt was not found and then realised I need to redurect my python exploit file into the server version because the flag file is on the server, not locally.

0