diff --git a/pie_time/.gdb_history b/pie_time/.gdb_history new file mode 100644 index 0000000..3e6f92d --- /dev/null +++ b/pie_time/.gdb_history @@ -0,0 +1,14 @@ +exit +exit +help +data +help data +list main +file vuln +list main +exec vuln +exec-file vuln +list main +file vuln +list main +exit diff --git a/pie_time/notes.md b/pie_time/notes.md new file mode 100644 index 0000000..ef4601d --- /dev/null +++ b/pie_time/notes.md @@ -0,0 +1,3 @@ +- objdump to find adress of main() and win() +- calculate final adress main_address - main_offset + win_offset + diff --git a/pie_time/vuln b/pie_time/vuln new file mode 100644 index 0000000..986868d Binary files /dev/null and b/pie_time/vuln differ diff --git a/pie_time/vuln.c b/pie_time/vuln.c new file mode 100644 index 0000000..eefc0ad --- /dev/null +++ b/pie_time/vuln.c @@ -0,0 +1,49 @@ +#include +#include +#include +#include + +void segfault_handler() { + printf("Segfault Occurred, incorrect address.\n"); + exit(0); +} + +int win() { + FILE *fptr; + char c; + + printf("You won!\n"); + // Open file + fptr = fopen("flag.txt", "r"); + if (fptr == NULL) + { + printf("Cannot open file.\n"); + exit(0); + } + + // Read contents from file + c = fgetc(fptr); + while (c != EOF) + { + printf ("%c", c); + c = fgetc(fptr); + } + + printf("\n"); + fclose(fptr); +} + +int main() { + signal(SIGSEGV, segfault_handler); + setvbuf(stdout, NULL, _IONBF, 0); // _IONBF = Unbuffered + + printf("Address of main: %p\n", &main); + + unsigned long val; + printf("Enter the address to jump to, ex => 0x12345: "); + scanf("%lx", &val); + printf("Your input: %lx\n", val); + + void (*foo)(void) = (void (*)())val; + foo(); +} \ No newline at end of file