diff --git a/cache_me_outside/.ghidra.test.lock~~ b/cache_me_outside/.ghidra.test.lock~~ new file mode 100644 index 0000000..e69de29 diff --git a/cache_me_outside/Makefile b/cache_me_outside/Makefile new file mode 100755 index 0000000..d297b02 --- /dev/null +++ b/cache_me_outside/Makefile @@ -0,0 +1,5 @@ +all: + gcc -Xlinker -rpath=./ -Wall -m64 -pedantic -no-pie --std=gnu99 -o heapedit heapedit.c + +clean: + rm heapedit diff --git a/cache_me_outside/cache_me_outside.gpr b/cache_me_outside/cache_me_outside.gpr new file mode 100644 index 0000000..e69de29 diff --git a/cache_me_outside/cache_me_outside.rep/idata/00/00000000.prp b/cache_me_outside/cache_me_outside.rep/idata/00/00000000.prp new file mode 100644 index 0000000..c47dee3 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/idata/00/00000000.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/cache_me_outside/cache_me_outside.rep/idata/00/~00000000.db/db.2.gbf b/cache_me_outside/cache_me_outside.rep/idata/00/~00000000.db/db.2.gbf new file mode 100644 index 0000000..0dba070 Binary files /dev/null and b/cache_me_outside/cache_me_outside.rep/idata/00/~00000000.db/db.2.gbf differ diff --git a/cache_me_outside/cache_me_outside.rep/idata/00/~00000000.db/db.3.gbf b/cache_me_outside/cache_me_outside.rep/idata/00/~00000000.db/db.3.gbf new file mode 100644 index 0000000..ae664dc Binary files /dev/null and b/cache_me_outside/cache_me_outside.rep/idata/00/~00000000.db/db.3.gbf differ diff --git a/cache_me_outside/cache_me_outside.rep/idata/~index.bak b/cache_me_outside/cache_me_outside.rep/idata/~index.bak new file mode 100644 index 0000000..f76fd84 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/idata/~index.bak @@ -0,0 +1,5 @@ +VERSION=1 +/ + 00000000:heapedit_patched:c0a8b2a0ecfb18259285716900 +NEXT-ID:1 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cache_me_outside/cache_me_outside.rep/idata/~index.dat b/cache_me_outside/cache_me_outside.rep/idata/~index.dat new file mode 100644 index 0000000..f76fd84 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/idata/~index.dat @@ -0,0 +1,5 @@ +VERSION=1 +/ + 00000000:heapedit_patched:c0a8b2a0ecfb18259285716900 +NEXT-ID:1 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cache_me_outside/cache_me_outside.rep/project.prp b/cache_me_outside/cache_me_outside.rep/project.prp new file mode 100644 index 0000000..9ad0e4c --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/project.prp @@ -0,0 +1,6 @@ + + + + + + diff --git a/cache_me_outside/cache_me_outside.rep/projectState b/cache_me_outside/cache_me_outside.rep/projectState new file mode 100644 index 0000000..c9027f2 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/projectState @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/cache_me_outside/cache_me_outside.rep/user/00/00000000.prp b/cache_me_outside/cache_me_outside.rep/user/00/00000000.prp new file mode 100644 index 0000000..d4e2595 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/user/00/00000000.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/cache_me_outside/cache_me_outside.rep/user/00/~00000000.db/db.1.gbf b/cache_me_outside/cache_me_outside.rep/user/00/~00000000.db/db.1.gbf new file mode 100644 index 0000000..20f3a38 Binary files /dev/null and b/cache_me_outside/cache_me_outside.rep/user/00/~00000000.db/db.1.gbf differ diff --git a/cache_me_outside/cache_me_outside.rep/user/00/~00000000.db/db.2.gbf b/cache_me_outside/cache_me_outside.rep/user/00/~00000000.db/db.2.gbf new file mode 100644 index 0000000..f9470cf Binary files /dev/null and b/cache_me_outside/cache_me_outside.rep/user/00/~00000000.db/db.2.gbf differ diff --git a/cache_me_outside/cache_me_outside.rep/user/~index.bak b/cache_me_outside/cache_me_outside.rep/user/~index.bak new file mode 100644 index 0000000..b776dc3 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/user/~index.bak @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cache_me_outside/cache_me_outside.rep/user/~index.dat b/cache_me_outside/cache_me_outside.rep/user/~index.dat new file mode 100644 index 0000000..80d6dc6 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/user/~index.dat @@ -0,0 +1,5 @@ +VERSION=1 +/ + 00000000:udf_c0a8b2a0ecfb18259285716900:c0a8b2a0fa9225658685323700 +NEXT-ID:1 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cache_me_outside/cache_me_outside.rep/user/~journal.bak b/cache_me_outside/cache_me_outside.rep/user/~journal.bak new file mode 100644 index 0000000..49482e2 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/user/~journal.bak @@ -0,0 +1,2 @@ +IADD:00000000:/udf_c0a8b2a0ecfb18259285716900 +IDSET:/udf_c0a8b2a0ecfb18259285716900:c0a8b2a0fa9225658685323700 diff --git a/cache_me_outside/cache_me_outside.rep/versioned/~index.bak b/cache_me_outside/cache_me_outside.rep/versioned/~index.bak new file mode 100644 index 0000000..b776dc3 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/versioned/~index.bak @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cache_me_outside/cache_me_outside.rep/versioned/~index.dat b/cache_me_outside/cache_me_outside.rep/versioned/~index.dat new file mode 100644 index 0000000..b776dc3 --- /dev/null +++ b/cache_me_outside/cache_me_outside.rep/versioned/~index.dat @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cache_me_outside/flag.txt b/cache_me_outside/flag.txt new file mode 100644 index 0000000..02da678 --- /dev/null +++ b/cache_me_outside/flag.txt @@ -0,0 +1 @@ +testFLAG diff --git a/cache_me_outside/heapedit b/cache_me_outside/heapedit new file mode 100755 index 0000000..264b087 Binary files /dev/null and b/cache_me_outside/heapedit differ diff --git a/cache_me_outside/heapedit_patched b/cache_me_outside/heapedit_patched new file mode 100755 index 0000000..e46764d Binary files /dev/null and b/cache_me_outside/heapedit_patched differ diff --git a/cache_me_outside/inputs b/cache_me_outside/inputs new file mode 100644 index 0000000..324b64f Binary files /dev/null and b/cache_me_outside/inputs differ diff --git a/cache_me_outside/ld-2.27.so b/cache_me_outside/ld-2.27.so new file mode 100755 index 0000000..a2e3b9a Binary files /dev/null and b/cache_me_outside/ld-2.27.so differ diff --git a/cache_me_outside/libc.so.6 b/cache_me_outside/libc.so.6 new file mode 100755 index 0000000..5cb8ffa Binary files /dev/null and b/cache_me_outside/libc.so.6 differ diff --git a/cache_me_outside/sol.py b/cache_me_outside/sol.py new file mode 100755 index 0000000..b820e1a --- /dev/null +++ b/cache_me_outside/sol.py @@ -0,0 +1,31 @@ +#!/usr/bin/env python3 + +from pwn import * + +exe = ELF("./heapedit_patched") +libc = ELF("./libc.so.6") +ld = ELF("./ld-2.27.so") + +context.binary = exe + + +def conn(): + if args.LOCAL: + r = process([exe.path]) + if args.DEBUG: + gdb.attach(r) + else: + r = remote("addr", 1337) + + return r + + +def main(): + r = conn() + r.recvuntil(b"Address: ") + + r.interactive() + + +if __name__ == "__main__": + main()