bugbear

[LOB] Level14: bugbear → giant

giant keyword : RTL(Returen To Library) /* The Lord of the BOF : The Fellowship of the BOF - giant - RTL2 */ #include #include #include main(int argc, char *argv[]) { char buffer[40]; FILE *fp; char *lib_addr, *execve_offset, *execve_addr; char *ret; if(argc < 2){ printf("argv error\n"); exit(0); } // gain address of execve fp = popen("/usr/bin/ldd /home/giant/assassin | /bin/grep libc | /bin/aw..

[LOB] Level13: darkknight → bugbear

bugbear keyword : RTL /* The Lord of the BOF : The Fellowship of the BOF - bugbear - RTL1 */ #include #include main(int argc, char *argv[]) { char buffer[40]; int i; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] == '\xbf') { printf("stack betrayed you!!\n"); exit(0); } strcpy(buffer, argv[1]); printf("%s\n", buffer); } 분기문을 통해 RET 부분에 덮여씌워지는 주소 앞주소'\xbf'를 필터링 한다. 즉, '\xbf'로 시작하..