정보보안전문가지망생

[pwnable.xyz] two targets

소스코드// local variable allocation has failed, the output may be wrong!int __fastcall __noreturn main(int argc, const char **argv, const char **envp){ int int32; // eax char s[32]; // [rsp+10h] [rbp-40h] BYREF char v5[16]; // [rsp+30h] [rbp-20h] OVERLAPPED BYREF __int64 v6; // [rsp+40h] [rbp-10h] unsigned __int64 v7; // [rsp+48h] [rbp-8h] v7 = __readfsqword(0x28u); setup(argc, argv, envp); ..

[pwnable.xyz] xor

소스코드int __fastcall __noreturn main(int argc, const char **argv, const char **envp){ int v3; // [rsp+Ch] [rbp-24h] __int64 v4; // [rsp+10h] [rbp-20h] BYREF __int64 v5; // [rsp+18h] [rbp-18h] BYREF __int64 v6; // [rsp+20h] [rbp-10h] BYREF unsigned __int64 canary; // [rsp+28h] [rbp-8h] canary = __readfsqword(0x28u); puts("The Poopolator"); setup("The Poopolator", argv); while ( 1 ) { v..

[pwnable.xyz] note

소스코드int __fastcall main(int argc, const char **argv, const char **envp){ int int32; // eax setup(argc, argv, envp); puts("Note taking 101."); while ( 1 ) { while ( 1 ) { while ( 1 ) { print_menu(); int32 = read_int32(); if ( int32 != 1 ) break; edit_note(); } if ( int32 != 2 ) break; edit_desc(); } if ( !int32 ..

[pwnable.xyz] GrownUp

소스코드unsigned int setup(){ setvbuf(stdout, 0LL, 2, 0LL); setvbuf(stdin, 0LL, 2, 0LL); signal(14, handler); qword_601160 = &byte_601168; byte_601168 = '%'; byte_601169 = 's'; byte_60116A = '\n'; return alarm(0x3Cu);}void __noreturn handler(){ exit(1);}int __fastcall main(int argc, const char **argv, const char **envp){ char *src; // [rsp+8h] [rbp-28h] __int64 buf[4]; // [rsp+10h] [rbp-2..

[pwnable.xyz] misalignment

소스코드int __fastcall main(int argc, const char **argv, const char **envp){ __int64 s[20]; // [rsp+10h] [rbp-A0h] BYREF s[19] = __readfsqword(0x28u); setup(argc, argv, envp); memset(s, 0, 0x98uLL); *(&s[1] + 7) = 0xDEADBEEFLL; while ( _isoc99_scanf("%ld %ld %ld", &s[4], &s[5], &s[6]) == 3 && s[6] = -7 ) { s[s[6] + 7] = s[4] + s[5]; printf("Result: %ld\n", s[s[6] + 7]); } if ( *(&s[1]..

[pwnable.xyz] add

소스코드int __fastcall main(int argc, const char **argv, const char **envp){ __int64 v4; // [rsp+8h] [rbp-78h] BYREF __int64 v5; // [rsp+10h] [rbp-70h] BYREF __int64 v6; // [rsp+18h] [rbp-68h] BYREF __int64 v7[12]; // [rsp+20h] [rbp-60h] BYREF v7[11] = __readfsqword(0x28u); setup(argc, argv, envp); while ( 1 ) { v4 = 0LL; v5 = 0LL; v6 = 0LL; memset(v7, 0, 0x50uLL); printf("Inp..

[pwnable.xyz] sub

소스코드__int64 __fastcall main(__int64 a1, char **a2, char **a3){ int v4; // [rsp+0h] [rbp-18h] BYREF int v5; // [rsp+4h] [rbp-14h] BYREF unsigned __int64 canary; // [rsp+8h] [rbp-10h] canary = __readfsqword(0x28u); setbuf(); v4 = 0; v5 = 0; _printf_chk(1LL, "1337 input: "); _isoc99_scanf("%u %u", &v4, &v5); if ( v4  분석숫자 2개를 입력 받고 두 숫자가 4918보다 같거나 작은지 검사한다음 v4-v5가 4919이면 플래그를 준다.그런데 unsi..

[pwnable.xyz] Welcome

소스코드__int64 __fastcall main(__int64 a1, char **a2, char **a3){ _QWORD *v3; // rbx char *v4; // rbp size_t v5; // rdx size_t size[5]; // [rsp+0h] [rbp-28h] BYREF size[1] = __readfsqword(0x28u); sub_B4E(a1, a2, a3); puts("Welcome."); v3 = malloc(0x40000uLL); *v3 = 1LL; _printf_chk(1LL, "Leak: %p\n", v3); _printf_chk(1LL, "Length of your message: "); size[0] = 0LL; _isoc99_scanf("%lu",..

[Dreamhack] rop

분석[소스 코드]// Name: rop.c// Compile: gcc -o rop rop.c -fno-PIE -no-pie#include #include int main() { char buf[0x30]; setvbuf(stdin, 0, _IONBF, 0); setvbuf(stdout, 0, _IONBF, 0); // Leak canary puts("[1] Leak Canary"); write(1, "Buf: ", 5); read(0, buf, 0x100); printf("Buf: %s\n", buf); // Do ROP puts("[2] Input ROP payload"); write(1, "Buf: ", 5); read(0, buf, 0x100); return 0;}소스 보면 ..