starnakin/42_rainfall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: bunch of improvements and typos in the walkthrough

Browse Source
This commit is contained in:
0x35c
2025-05-07 14:04:04 +02:00
parent ca011b34f4
commit fb1ba7aee8
11 changed files with 35 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
level1/walkthrough
View File

@ -1,9 +1,9 @@
# Level1
Using ghidra, we can decompile the code and see that it fills a buffer of 76 bytes using the deprecated (unsafe) function `gets`.
Using ghidra, we can decompile the code and see that it fills a buffer of 76 bytes using the deprecated (unsafe) function `gets()`.
We can exploit this call to overflow the stack and call another function.
In the binary, there is a function `run()` located at address 0x8048444 that runs `/bin/sh`.
In the binary, there is a function `run()` located at address 0x8048444 that calls `system("/bin/sh")`.
To exploit this, we can use this sh command with this inline python script:
`(print('a'*76 + "\x44\x84\x04\x08"); cat) | ./level1`
This will print `run()`'s address on the stack, after the buffer being written to by `gets`, resulting in a call to the function.
`(print('A'*76 + "\x44\x84\x04\x08"); cat) | ./level1`
This will print `run()`'s address to `eip`, after the buffer being written to by `gets()`, resulting in a call to the function.
The parenthesis and the `cat` are mandatory to make it blocking and keep the shell opened.