본문 바로가기

Wargame Write-Up/Pwnable.kr5

[Pwnable.kr] dragon 풀이 dragon TL;DR IntegerOverflow (Logical bug?) + UAF void __cdecl FightDragon(int select) { char v1; // al int v2; // [esp+10h] [ebp-18h] int *player; // [esp+14h] [ebp-14h] int *dragon; // [esp+18h] [ebp-10h] void *v5; // [esp+1Ch] [ebp-Ch] player = malloc(0x10u); dragon = malloc(0x10u); v1 = Count++; if ( (v1 & 1) != 0 ) { dragon[1] = 1; *(dragon + 8) = 80; *(dragon + 9) = 4; dragon[3] = 10; *dra.. 2021. 10. 11.
[Pwnable.kr] otp 풀이 ulimit 으로 푸는 문제라 하더라고요,, 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 #include #include #include #include int main(int argc, char* argv[]){ char fname[128]; unsigned long long otp[2]; if(argc!=2){ printf("usage : ./otp [passcode]\n"); return 0; } int fd = open("/dev/urandom", O_RDONLY); if(fd==-1) exit(-1); if(read(.. 2021. 4. 7.
[Pwnable.kr] (Pwnable) simple login 풀이 simple login | 50 pt 50 point 이므로, 페이로드가 비교적 짧을것같다. Authenticate : snwo hash : f95abb977080593669adc510ab8e16d7 이렇게 입력을 받고, 해쉬값을 생성해서 종료한다. main ( void ) undefined4 main(void) { int iVar1; void *local_38; undefined local_32 [30]; uint local_14; memset(local_32,0,0x1e); setvbuf((FILE *)stdout,(char *)0x0,2,0); setvbuf((FILE *)stdin,(char *)0x0,1,0); printf("Authenticate : "); __isoc99_scanf(&DAT_.. 2020. 7. 30.
[Pwnable.kr] (Pwnable) md5 calculator 풀이 md5 calculator | 200pt captcha 를 입력받고, BASE64 인코딩된값을 입력받고, MD5 한 결과를 돌려준다. gdb-peda$ checksec hash CANARY : ENABLED FORTIFY : disabled NX : ENABLED PIE : disabled RELRO : Partial 카나리와 NX가 설정되어있다. main undefined4 main(void) { uint __seed; int local_18; int local_14; setvbuf(stdout,(char *)0x0,1,0); setvbuf(stdin,(char *)0x0,1,0); puts("- Welcome to the free MD5 calculating service -"); __seed = t.. 2020. 7. 29.

티스토리툴바