basic_exploitation_001

So I downloaded it directly to Ubuntu using curl, but for some reason it didn't unzip I tried to compile the c file directly according to security information, but it's not easy because I also faced linking errors with various libraries. Is there an easier way?

pwndbg> checksec [*] '/home/kali/basic2' Arch: i386-32-little RELLO: No RELLO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) Disabling security is the same

When I just print read_flag, the address appears as 0x8e2 pwndbg> print read_flag $1 = {<text variable, no debug info>} 0x8e2 <read_flag> If you run it and save it again pwndbg> print read_flag $2 = {<text variable, no debug

Somehow, the problem was solved. However, even if I first entered the read_flag address through the gdb info function, I couldn't connect, so when I looked for it, the address came up differently. Addresses cannot be written here, and addresses that are 80 greater than the correct answer address are displayed as read_flag addresses. (Every function has a different address than others.) What part of the error occurred

I solved it using the read_flag function, but I have a question, so I have a question. I obtained the address of the system function and the “/bin/sh” string address according to the method in the DreamHack RTL course and put them in a buffer, and confirmed that it ran into the system function and that even the /bin/sh string pointer was properly inserted into the eax register from within the function, but the example1.c file in the lesson

Because the flag is output when the read_flag function is executed after the payload is submitted p = remote (“,”) p = remote (“) .. Omit.. flag = p.recvline () print (flag) I did it like this Traceback (most recent call last): File “ex.p

! [image.png] (https://dreamhack-media.s3.amazonaws.com/attachments/0e1e909127ad4821d7af97afac896584a8b6e35352a45f93e9a9891415b1d196.png) fallacy ! [image.png] (https://dreamhack-media.s3.amazonaws.com/attac

I'm trying to solve the basic_exploitation_001 problem using ROP, but I have a question, so I'm posting it. from pwn import* context.log_level = 'debug' #p = remote ('host3.dreamhack.games', 15998) p= process ('. /basic_exploitation_001 ') e = E

message=b'a'*0x84+p32 (0x80485b9) p.sendline (message) This is how I got an answer, but... What I'm really curious about is that when the message is roughly B'aaaa... ax/b9\ x85\ x04\ x08', why is only the return address part changed to Little Endian..? If you want to change it, change it to a barrel x/b9\ x8

Hello, I'm practicing with the 64bit version of Ubuntu 22.03. I also installed i386 to switch to the 64-bit version. I solved the problem by using pwntools with 132 A and entering the address of the function in the shell As shown below, cat: flag: If there is no such file or directory, an error appears.. Did I make a mistake? Or how should I fix the error? [+] Starti