45 lines
574 B
Markdown
45 lines
574 B
Markdown
# one byte
|
|
|
|
```
|
|
Here's a one byte buffer overflow!
|
|
|
|
Author: joseph
|
|
nc 2023.ductf.dev 30018
|
|
```
|
|
|
|
# Source
|
|
|
|
## onebyte.c
|
|
|
|
```c
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <stdlib.h>
|
|
|
|
void init() {
|
|
setvbuf(stdout, 0, 2, 0);
|
|
setvbuf(stdin, 0, 2, 0);
|
|
}
|
|
|
|
void win() {
|
|
system("/bin/sh");
|
|
}
|
|
|
|
int main() {
|
|
init();
|
|
|
|
printf("Free junk: 0x%lx\n", init);
|
|
printf("Your turn: ");
|
|
|
|
char buf[0x10];
|
|
read(0, buf, 0x11);
|
|
}
|
|
```
|
|
|
|
# Analyse
|
|
|
|
Das Ziel ist recht eindeutig. Wir kontrollieren 1 Byte und sollen einen Sprung nach win() bewirken.
|
|
|
|
# Lösung
|
|
|
|
#TODO |