One is enough
| ID： | 2063 |
|---|---|
| 标题： | One is enough |
| 描述： | Notes: There is an off by one in readInput function. The call tree main -> readDescription -> readInput would result in overwriting a nullbyte in the least significant byte of the saved RBP in readDescription call-stack. The leave; ret instruction at the end of the readDescription would result in restoring the saved RBP after being modified. Chained with the leave; ret instruction at the end of the main function, this would result in a stack pivot. Send a large enough payload with a new line (which will be overwritten with a null byte). The payload should contain a ROP chain. This won't be always successful, the solve I provided calls readInput to write a stage 2 rop chain in bss then stack pivots. |
| 类型： | PWN |
| 网站： | bugku |
| 题目链接： | https://ctf.bugku.com/challenges/detail/id/2210.html |
| 赛事： | SecurinetsQualsCTF2023 |
| 年度： | 2023 |
| Flag值： | securinets{3bcc81811533d70940084c8} |
| writeup： | https://zhuanlan.zhihu.com/p/649938547 |