#Stack smashing detected c 2017 software#

puts print second menu item | || 0x00400aed 488d45cc lea rax, qword puts print first menu option | || 0x00400ae3 bffa0c4000 mov edi, str. Ptrace (PT_ATTACH) : Operation not permitted PIDPATH: /home/tobaljackson/SIT/fall_2017/asisCTF_9-08-2017/pwn_Greg-Lestrade/writeup/greg_lestradeДЄssuming filepath /home/tobaljackson/SIT/fall_2017/asisCTF_9-08-2017/pwn_Greg-Lestrade/writeup/greg_lestrade

I threw together this python script to achieve this: I often use python in conjunction with radare2 so that I can have both programmatic I/O through pwntools as well as the debugging/disassembling capabilities attached to the same process. I threw together the beginnings of my solver script.

#Stack smashing detected c 2017 software#

Once again, I equipped a software lens through which to view this challenge.

Give me your command : aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xДЄs you can see, the 'secret' pasphrase got us into the admin menu, but trying some cursory input left me curious what it was doing. for secure commands, only lower cases are expected. Give me your command : aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%xДЄaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa%x I used this string to see what happened next: Looking at this disassembly, it was easy to see that this function compared the input against a secret string. On linux, man 3 strncmp will show us that the signature for strncmp is int strncmp(const char *s1, const char *s2, size_t n), meaning that this program is calling strncmp(secret, input, strlen(input)) On x86-64 the ABI specifies that arguments are passed via the registers rdi, rsi, rdx, rcx, r8, r9, in that order. On the highlighted line above, the strncmp call invokes c's string-comparison function. | 0x00400902 4889ce mov rsi, rcx pointer to our input string | 0x00400905 4889c7 mov rdi, rax pointer to secret string above | 0x00400908 e8b3fdffff call sym. This tells me that this function likely is validating our input. Once the program has read in our data, the routine sub.strlen_8d9 is called, followed by a test-and-branch we can see on the last two lines above. After printing the prompts, the program then reads 0x200 bytes of data (2nd highlighted line) into a local frame buffer using (3rd highlighted line). We can see on the first highlighted line above where our main routine starts by recognizing the string references we saw when the program was originally run.

Constructing a function name for fcn.* and sym.func.* functions (aan) Use -AA or aaaa to perform additional experimental analysis. Analyze len bytes of instructions for references (aar)