April 19, 2018

Root me write-up : ELF x64 - Stack buffer overflow - basic

To comply with the write-up rule of root-me.org, in this write-up, I just talk about some hints related this challenge. Here is no solution and correct answer.


ELF x64 - Stack buffer overflow

This is regular buffer overflow challenge except the architecture.

Because this challenge is based on x86_64, you should be careful calculating related the size of the memory.

Also note that the vulnerable function is not library dependent.

April 04, 2018

Root me write-up : ELF x86 - Format string bug basic 1

To comply with the write-up rule of root-me.org, in this write-up, I just talk about some hints related this challenge. Here is no solution and correct answer.



The basic of FSB(Format String Bug) is %x. Check the link, it would help you.

Root me write-up : ELF x86 - Stack buffer overflow basic 2

To comply with the write-up rule of root-me.org, in this write-up, I just talk about some hints related this challenge. Here is no solution and correct answer.


disassembled main of Stack buffer overflow basic 2

The distance is 0x9c-0x1c = 0x80.

The input size of "fgets" is 133.

Function pointer.

Root me write-up : ELF x86 - Stack buffer overflow basic 1

To comply with the write-up rule of root-me.org, in this write-up, I just talk about some hints related this challenge. Here is no solution and correct answer.


source code of Stack buffer overflow basic 1

The function "fgets" receives 45 bytes input.

The size of array "buf" is 40 bytes.

April 02, 2018

Root me write-up : Stack buffer overflow basic 3

To comply with the write-up rule of root-me.org, in this write-up, I just talk about some hints related this challenge. Here is no solution and correct answer.


Stack buffer overflow basic 3 hint of root me

To solve this challenge, there is something to be careful.

Think about Little-endian, The "count++" inside the green box in the photo above, and the location of variables in memory. you can get enough the flag.

Also, since there is an infinite loop, I recommend you to use a debugger to test a payload.