FC3

[FC3] Level 5. evil_wizard → dark_stone

dark_stone keyword : POP POP RET / Remote /* The Lord of the BOF : The Fellowship of the BOF - dark_stone - Remote BOF on Fedora Core 3 - hint : GOT overwriting again - port : TCP 8888 */ #include // magic potion for you from socket import * void pop_pop_ret(void) { asm("pop %eax"); asm("pop %eax"); asm("ret"); } int main() { char buffer[256]; char saved_sfp[4]; int length; char temp[1024]; prin..

[FC3] Level 4. hell_fire → evil_wizard

evil_wizard keyword : POP POP RET /* The Lord of the BOF : The Fellowship of the BOF - evil_wizard - Local BOF on Fedora Core 3 - hint : GOT overwriting */ // magic potion for you void pop_pop_ret(void) { asm("pop %eax"); asm("pop %eax"); asm("ret"); } int main(int argc, char *argv[]) { char buffer[256]; char saved_sfp[4]; int length; if(argc < 2){ printf("argv error\n"); exit(0); } // for distu..

[FC3] Level 3. dark_eyes → hell_fire

hell_fire keyword : another fake_ebp or got overwriting /* The Lord of the BOF : The Fellowship of the BOF - hell_fire - Remote BOF on Fedora Core 3 - hint : another fake ebp or got overwriting - port : TCP 7777 */ #include int main() { char buffer[256]; char saved_sfp[4]; char temp[1024]; printf("hell_fire : What's this smell?\n"); printf("you : "); fflush(stdout); // give me a food fgets(temp,..

[FC3] Level 2. iron_golem → dark_eyes

dark_eyes Keyword : RET Sleding /* The Lord of the BOF : The Fellowship of the BOF - dark_eyes - Local BOF on Fedora Core 3 - hint : RET sleding */ int main(int argc, char *argv[]) { char buffer[256]; char saved_sfp[4]; if(argc < 2){ printf("argv error\n"); exit(0); } // save sfp memcpy(saved_sfp, buffer+264, 4); // overflow!! strcpy(buffer, argv[1]); // restore sfp memcpy(buffer+264, saved_sfp,..

[FC3] Level 1. gate → iron_golem

iron_golem keyword : Fake_SFP + Ascii /* The Lord of the BOF : The Fellowship of the BOF - iron_golem - Local BOF on Fedora Core 3 - hint : fake ebp */ int main(int argc, char *argv[]) { char buffer[256]; if(argc < 2){ printf("argv error\n"); exit(0); } strcpy(buffer, argv[1]); printf("%s\n", buffer); } f6dea000-f6df1000 rw-p f6dea000 00:00 0 f6df1000-f6df7000 r--s 00000000 fd:00 572196 /usr/lib..

[FC3] Fedora Catle 3

[FC3 - 총 5문제] FC1~FC3까지 동일 환경이기 때문에 FC3 환경에서부터 시작합니다. [주소] http://hackerschool.org/TheLordofBOF/VM_FC3.zip [환경 요약] Stack Dummy : O Down privileage of bash : O Random Stack : O Random Library : X Random Program Binary Mapped : X ASCII Armor : O Non-Executable Stack : O Non-Executable Heap : O Stack Carany : X Stack Smashing Protector : X [몹들] gate -> iron_golem : Fake_SFP + Ascii Armor iron_golem..