DUARRRR MEME

Okay, that maybe too much.

Now let's see about what we need to bomb next.

So the next thing we need to bomb is the ward, because we all hate those observer and sentry wards that ruins our marvelous ganking plan, ay.

And on this stage, we need to call a function, probably destroy_ward().

BUT, HERE IS THE BUT.

Change the global variable first.

And here is where it goes tricky, and annoying.

When we declare a global variable, the value is stored NOT in the stack, but in the "beginning" of the memory. Well, it's not really the beginning, but it's somewhere in the beginning of the RAM nonetheless. You can see this from the local variable address and global variable address.

When declaring local variable, the value it stored in the stack, while the global variable is not in the stack.

And because our buffer is stored in the stack, we basically have no way to overwrite the global variable, because it stored in the low memory, while buffer overflow overwrite to the high memory.

OH NO IT'S A DISASTAH

But fear not, that is why the hint comes.

The hint simply said that there is a helper function for thisᵗᵐ.

Let's open GDB, then write :

info functions

After that, GDB will print every single symbols/function that the program has.

Woah see dat.

What is that "not_an_important_function_TM" doing there...

Hmm.....

Let's disassemble that... thing.

In a glimpse, this function is going to modify the value of "something". (spoiler: it's the both global variables)

What is this something, you ask?

Let's actually drive our current input.txt in order to execute this function.

First, locate the address. Like in Stage 3, just use

print *not_an_important_function_TM

Now that we found the address. let's set the input.txt so that the program executes the... function.... welp.

61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 99 05 5d 31 aa aa aa aa bb bb bb bb cc cc cc cc 12 92 04 08

Set the breakpoint at the "ret" instruction on ekusupuroshion_magic so that we can step into the function step by step, then run the program.

Open our beloved layout and now we're in the "ret" instruction, yet again.

Step one by one until you get into the function.... if you succeed.

And now we're in!

But do you notice something?

Look at the values of %ebx and %ebp.

Surely it got overwritten by our input. We may have written too much, but that should not be a problem because we seemingly don't have any instruction that explicitly use the value of %ebp or %ebx.

Let's add breakpoint at the end of this not so important function, so that we can see where are we going to jump next.

If you check the value of the global variables, we can see that they have been changed by the not so important function, so I see this as an absolute win!

Now, where are we jumping next?

Let's check the value of the top of the stack

The top of the stack points into 0xffffcf20, weirdly enough the place where the address of the not so important function stored is switched with the previous address, BUT THAT'S NOT IMPORTANT.

Because we know that it's going to jump to somewhere from the information stored in 0xffffcf20, let's change the value stored on that address into the address of destroy_ward.

If you did your job correctly, then congrats!

We're in!

Everything should go correctly, and the flag should've been revealed now.

Congrats on solving the 4th stage!

Now it's your job to adjust your input with the potions and addresses in the server, and it's free real estate.

BOI, WE'RE ONE STEP FROM THE VICTORY.

But chotto a minute/an hour, ada kelas abis ini wkwk.

Stage 5 nyusul.

Loading...

There will be awesome contents here

Orkom3 Write-Up : Stage 4 - Destroy Ward