Okay so, I'm gonna be fast here.

Assuming that the reader already have the basic of buffer overflow, then it's just about determining which place we need to modify, which aren't.

If you look closer on the source code that was given (rebuild-overflow.c), the program declares a local variable with the size of 4 bytes (unsigned int) with the value of the "potion", and then buffer with the size of 24 bytes. Because it's local variable, the variable value is pushed into the stack instead. It goes in order as the "local" was pushed first, then the "buf".

Good thing the program gave us the information about the "buf" address.

A quick check on GDB the contents and everything around it reveals that the "local" value is 24 bytes ahead the "buf" position.

> How to check : x/32x <buf address>

> Replace <buf address> with the address that was told. "x/32x" means that we're checking the memory for about 32*4 bytes ahead the reference point.

When we see the source code yet again, in order to access destroy_drawbridge(), we need to change the value of "local" variable with basically anything so that it doesn't match the value of the global variable.

Because the buffer is 24 bytes long, giving input for at least 25 bytes can already change the value of "local" that's stored on stack. Placing breakpoint after gets function called then checking the stack can tell everything.

Fill the first 24 bytes with anything, then also anything on the 25th bytes onward.

Note : Inputting string directly on the terminal can sometimes will add an additional null byte at the end. Remember that string is basically array of chars that's null terminated. So writing down 24 characters will input 25 bytes (24 bytes for the characters, 1 byte for the null).

And then there goes the flag.

Because the flag can only be obtained from the server, you can either :

Input the payload into the server, or
Write/use a python script to pipe the output as input into the server.

It's better to use the 2nd method as all the stages after this requires you to input non-ASCII characters.

As the handout also includes "hex2raw.py", we can use this script in order to input some non-ASCII characters.

The script reads a file "input.txt" in which every byte is separated by a space.

So then, make the "input.txt" file, fill it with 24 values of hexadecimal representation of the input (can be anything, honestly), then add some arbitrary bytes to "overflow" the buffer.

Run the python script and add your token as the first argument, then pipe the output into the netcat server.

And there you go.

Note that I'm using "AAAAAAAAAA" as the token, change this into your own token in order to get the correct flag.

And so that concludes the first stage.

Stage 2 nyusul uwu.

Orkom3 Write-Up : Stage 1 - Destroy Drawbridge