The classic stack buffer overflow. Overwrite the saved return address with win(), and it reads the flag for you.
win()
ssh [email protected]
The stack is executable and the program prints the address of your buffer. Write shellcode into the buffer, overflow the saved return address, and jump back to the buffer to run it.
The win() function is back but is now "more secure." Return into the middle of win_authed() to skip its check.
win_authed()
The bounds check uses a signed int, but fread() takes a size_t. A negative count slips past the check, then turns huge when the read happens.
int
fread()
size_t
You only control the low byte of the saved return address. PIE is on, but that byte is still enough to land in win().
PIE
The stack canary blocks a straight overwrite, so leak it first and put it back before you return into win().
A single byte past the buffer is enough when it lands on the low byte of the saved frame pointer. Let leave; ret do the rest.
leave; ret
This scoreboard reflects solves for challenges in this module after the module launched in this dojo.
7-Day | 30-Day | All-Time