Wargame

[lob] giant -> assassin

1. intro 2. code 및 분석 2.1. C code /* The Lord of the BOF : The Fellowship of the BOF - assassin - no stack, no RTL */ #include #include main(int argc, char *argv[]) { char buffer[40]; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] == '\xbf') { printf("stack retbayed you!\n"); exit(0); } if(argv[1][47] == '\x40') { printf("library retbayed you, too!!\n"); exit(0); } strcpy(buffer..

house_of_spirit

보호되어 있는 글입니다.

[lob] bugbear -> giant

1. intro 2. code 및 분석 2.1 C code /* The Lord of the BOF : The Fellowship of the BOF - giant - RTL2 */ #include #include #include main(int argc, char *argv[]) { char buffer[40]; FILE *fp; char *lib_addr, *execve_offset, *execve_addr; char *ret; if(argc < 2){ printf("argv error\n"); exit(0); } // gain address of execve fp = popen("/usr/bin/ldd /home/giant/assassin | /bin/grep libc | /bin/awk '{pri..

[lob] darkknight -> bugbear

1. intro 2. code 및 분석 2.1 C code /* The Lord of the BOF : The Fellowship of the BOF - bugbear - RTL1 */ #include #include main(int argc, char *argv[]) { char buffer[40]; int i; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] == '\xbf') { printf("stack betrayed you!!\n"); exit(0); } strcpy(buffer, argv[1]); printf("%s\n", buffer); } 2.3. 분석 2.3.1. assembler code (중요 부분) 지금까지는 retu..

[lob] golem -> darkknight

1. intro 2. code 및 분석 2.1 C code /* The Lord of the BOF : The Fellowship of the BOF - darkknight - FPO */ #include #include void problem_child(char *src) { char buffer[40]; strncpy(buffer, src, 41); printf("%s\n", buffer); } main(int argc, char *argv[]) { if(argc

[lob] skeleton -> golem

1. intro 2. code 및 분석 2.1 C code /* The Lord of the BOF : The Fellowship of the BOF - golem - stack destroyer */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] != '\xbf') { printf("stack is still your friend.\n"); exit(0); } strcpy(buffer, argv[1]); printf("%s\n", buffer); // stack de..

house_of_force

보호되어 있는 글입니다.

[lob] vampire -> skeleton

1. intro 2. code 및 분석 2.1 C code /* The Lord of the BOF : The Fellowship of the BOF - skeleton - argv hunter */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i, saved_argc; if(argc < 2){ printf("argv error\n"); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != '\xbf') { printf("stack is st..

[lob] troll -> vampire

1. intro 2. code 및 분석 2.1 C code /* The Lord of the BOF : The Fellowship of the BOF - vampire - check 0xbfff */ #include #include main(int argc, char *argv[]) { char buffer[40]; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] != '\xbf') { printf("stack is still your friend.\n"); exit(0); } // here is changed! if(argv[1][46] == '\xff') { printf("but it's not forever\n"); exit(0); ..

[lob] orge -> trol

1. intro 2. code 및 분석 2.1 C code /* The Lord of the BOF : The Fellowship of the BOF - troll - check argc + argv hunter */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; // here is changed if(argc != 2){ printf("argc must be two!\n"); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1][47] != '\xb..