diff options
| author | Louis Burda <quent.burda@gmail.com> | 2024-04-05 20:15:45 +0200 |
|---|---|---|
| committer | Louis Burda <quent.burda@gmail.com> | 2024-04-05 20:15:45 +0200 |
| commit | 66aad836f9e7dd5de4bdbf012c388e221614da5c (patch) | |
| tree | 7c76d3005acb2eb510820129124b4f3385e21b46 /chall/description | |
| parent | 88f4ea4c85a4224515ba1146b8058bce9e2a1994 (diff) | |
| download | cscg2024-pwn-master.tar.gz cscg2024-pwn-master.zip | |
Diffstat (limited to 'chall/description')
| -rw-r--r-- | chall/description | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/chall/description b/chall/description new file mode 100644 index 0000000..098f0a8 --- /dev/null +++ b/chall/description @@ -0,0 +1,7 @@ +This is an introductory challenge for exploiting Linux binaries with memory corruptions. Nowadays there are quite a few mitigations that make it not as straight forward as it used to be. So in order to introduce players to pwnable challenges, LiveOverflow created a video walkthrough of the first challenge. + +This challenge was already featured in last year's CSCG. We are aware that public writeups exist, but we figured this challenge is still a nice-to-have for newcomers, so we released it again. + +Note: The video writeup of LiveOverflow is not completely functional. To give you hint: It's about the address of the ret instruction that was chosen to re-align the stack. Suppose ASLR is rather 'smooth' - meaning a whole bunch of nibbles are zero - (which is pretty much always the case in our setup) all addresses within the offset range of 0xa00 to 0xaff translate to addresses looking like xxxxxxxxxx0axx, requiring you to send the bytes xx xx xx xx xx xx 0a xx over the wire. Now the problem with this is that 0a is a newline (\\n), which in turn terminates gets() (refer to man 3 gets), meaning that your payload terminates prematurely. + +https://www.youtube.com/watch?v=hhu7vhmuISY |