c0wb3ll's 5tudy B109

LOB death_knight

LOB death_knight get item [death_knight@localhost death_knight]$ ls dropped_item.txt [death_knight@localhost death_knight]$ cat dropped_item.txt You're so great! This is a token to the next gate. ,. ,' `. ,' __ `. ,'.-'____`-.`. ,'_.-'' ``-._`. ,',' /\ `.`. ,' /.._ O / \ O _.,\ `. ,'/ / \ ``-;.--.:-'' / \ \`. ,' : : \ /\`.,'/\ / : : `. () `. : : / \/,'`.\/ \ ; ; ,' `.\ \..

LOB xavius => death_knight

LOB xavius => death_knight 문제 /* The Lord of the BOF : The Fellowship of the BOF - dark knight - remote BOF */ #include #include #include #include #include #include #include #include #include main() { char buffer[40]; int server_fd, client_fd; struct sockaddr_in server_addr; struct sockaddr_in client_addr; int sin_size; if((server_fd = socket(AF_INET, SOCK_STREAM, 0)) == -1){ perror("socket"); e..

LOB nightmare => xavius

LOB nightmare => xavius 문제 /* The Lord of the BOF : The Fellowship of the BOF - xavius - arg */ #include #include #include main() { char buffer[40]; char *ret_addr; // overflow! fgets(buffer, 256, stdin); printf("%s\n", buffer); if(*(buffer+47) == '\xbf') { printf("stack retbayed you!\n"); exit(0); } if(*(buffer+47) == '\x08') { printf("binary image retbayed you, too!!\n"); exit(..

LOB succubus => nightmare

LOB succubus => nightmare 문제 [succubus@localhost succubus]$ cat nightmare.c /* The Lord of the BOF : The Fellowship of the BOF - nightmare - PLT */ #include #include #include #include main(int argc, char *argv[]) { char buffer[40]; char *addr; if(argc < 2){ printf("argv error\n"); exit(0); } // check address addr = (char *)&strcpy; if(memcmp(argv[1]+44, &addr, 4) != 0){ printf("You must fall in ..

LOB zombie_assassin => succubus

LOB zombie_assassin => succubus 문제 [zombie_assassin@localhost zombie_assassin]$ cat succubus.c /* The Lord of the BOF : The Fellowship of the BOF - succubus - calling functions continuously */ #include #include #include // the inspector int check = 0; void MO(char *cmd) { if(check != 4) exit(0); printf("welcome to the MO!\n"); // olleh! system(cmd); } void YUT(void) { if(check != 3) exit(0); pri..

LOB assassin => zombie_assassin

LOB assassin => zombie_assassin 문제 [assassin@localhost assassin]$ cat zombie_assassin.c /* The Lord of the BOF : The Fellowship of the BOF - zombie_assassin - FEBP */ #include #include main(int argc, char *argv[]) { char buffer[40]; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] == &#39;\xbf&#39;) { printf("stack retbayed you!\n"); exit(0); } if(argv[1][47] == &#39;\x40&#39;) { ..

LOB giant => assassin

LOB giant => assassin [giant@localhost giant]$ cat assassin.c /* The Lord of the BOF : The Fellowship of the BOF - assassin - no stack, no RTL */ #include #include main(int argc, char *argv[]) { char buffer[40]; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] == &#39;\xbf&#39;) { printf("stack retbayed you!\n"); exit(0); } if(argv[1][47] == &#39;\x40&#39;) { printf("library retba..

LOB bugbear => giant

LOB bugbear -> golem 문제 [bugbear@localhost bugbear]$ cat giant.c /* The Lord of the BOF : The Fellowship of the BOF - giant - RTL2 */ #include #include #include main(int argc, char *argv[]) { char buffer[40]; FILE *fp; char *lib_addr, *execve_offset, *execve_addr; char *ret; if(argc < 2){ printf("argv error\n"); exit(0); } // gain address of execve fp = popen("/usr/bin/ldd /home/giant/assassin |..

LOB darkknight => bugbear

LOB darkknight => bugbear 문제 [darkknight@localhost darkknight]$ cat bugbear.c /* The Lord of the BOF : The Fellowship of the BOF - bugbear - RTL1 */ #include #include main(int argc, char *argv[]) { char buffer[40]; int i; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] == &#39;\xbf&#39;) { printf("stack betrayed you!!\n"); exit(0); } strcpy(buffer, argv[1]); printf("%s\n", buffer..

LOB golem => darkknight

LOB golem => darkknight 문제 /* The Lord of the BOF : The Fellowship of the BOF - darkknight - FPO */ #include #include void problem_child(char *src) { char buffer[40]; strncpy(buffer, src, 41); printf("%s\n", buffer); } main(int argc, char *argv[]) { if(argc

LOB skeleton => golem

LOB skeleton => golem [skeleton@localhost skeleton]$ cat golem.c /* The Lord of the BOF : The Fellowship of the BOF - golem - stack destroyer */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] != &#39;\xbf&#39;) { printf("stack is still your friend.\n"); exit(0); } strcpy(buffer, argv[..

LOB vampire => skeleton

LOB vampire => skeleton 문제 [vampire@localhost vampire]$ cat skeleton.c /* The Lord of the BOF : The Fellowship of the BOF - skeleton - argv hunter */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i, saved_argc; if(argc < 2){ printf("argv error\n"); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i])); if(argv[1..

LOB troll => vampire

LOB troll => vampire 문제 [troll@localhost troll]$ cat vampire.c /* The Lord of the BOF : The Fellowship of the BOF - vampire - check 0xbfff */ #include #include main(int argc, char *argv[]) { char buffer[40]; if(argc < 2){ printf("argv error\n"); exit(0); } if(argv[1][47] != &#39;\xbf&#39;) { printf("stack is still your friend.\n"); exit(0); } // here is changed! if(argv[1][46] == &#39;\xff&#39;)..

LOB orge => troll

LOB orge => troll 문제 [orge@localhost orge]$ cat troll.c /* The Lord of the BOF : The Fellowship of the BOF - troll - check argc + argv hunter */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; // here is changed if(argc != 2){ printf("argc must be two!\n"); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strlen(environ[i]));..

LOB darkelf => orge

LOB darkelf => orge 문제 [darkelf@localhost darkelf]$ cat orge.c /* The Lord of the BOF : The Fellowship of the BOF - orge - check argv[0] */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc < 2){ printf("argv error\n"); exit(0); } // here is changed! if(strlen(argv[0]) != 77){ printf("argv[0] error\n"); exit(0); } // egghunter for(i=0; enviro..

LOB wolfman => darkelf

LOB wolfman => darkelf 문제 [wolfman@localhost wolfman]$ cat darkelf.c /* The Lord of the BOF : The Fellowship of the BOF - darkelf - egghunter + buffer hunter + check length of argv[1] */ #include #include extern char **environ; main(int argc, char *argv[]) { char buffer[40]; int i; if(argc < 2){ printf("argv error\n"); exit(0); } // egghunter for(i=0; environ[i]; i++) memset(environ[i], 0, strle..