iron_golem

[FC3] Level 2. iron_golem → dark_eyes

dark_eyes Keyword : RET Sleding /* The Lord of the BOF : The Fellowship of the BOF - dark_eyes - Local BOF on Fedora Core 3 - hint : RET sleding */ int main(int argc, char *argv[]) { char buffer[256]; char saved_sfp[4]; if(argc < 2){ printf("argv error\n"); exit(0); } // save sfp memcpy(saved_sfp, buffer+264, 4); // overflow!! strcpy(buffer, argv[1]); // restore sfp memcpy(buffer+264, saved_sfp,..

[FC3] Level 1. gate → iron_golem

iron_golem keyword : Fake_SFP + Ascii /* The Lord of the BOF : The Fellowship of the BOF - iron_golem - Local BOF on Fedora Core 3 - hint : fake ebp */ int main(int argc, char *argv[]) { char buffer[256]; if(argc < 2){ printf("argv error\n"); exit(0); } strcpy(buffer, argv[1]); printf("%s\n", buffer); } f6dea000-f6df1000 rw-p f6dea000 00:00 0 f6df1000-f6df7000 r--s 00000000 fd:00 572196 /usr/lib..