First off, let me state that I am not looking for someone to give me a straight answer to this question. The only thing I'm looking for is what I can read up on to be able to solve this problem myself.
So, I've been tasked with writing an exploit to get a flag.txt file printed out. The program is written in c.
I've been given the source code in c and the compiled 64-bit ELF file. So I fired up gdb.
Here's my problem:
I first filled the buffer by entering a long sequence of a's, and then printed the memory using
x /20x
to check it out. And here is what got printed:
0x7fffffffde50: 0xffffdf98 0x00007fff 0xffffe2e9 0x00000001
0x7fffffffde50: 0xf7fd15e0 0x00007fff 0x5555531d 0xdeadbeef
0x7fffffffde50: 0x61616161 0x61616161 0x61616161 0x61616161
0x7fffffffde50: 0x61616161 0x61616161 0x61616161 0x61616161
0x7fffffffde50: 0x61616161 0x61616161 0x61616161 0x61616161
What I aim to do is to overwrite the variable that is stored as 0xdeadbeef in memory. But as far as I know, the buffer is located after this in the memory. So, I'm asking if there is some sort of specific type of overflow attack I must use. Any pointers are greatly appreciated!
User contributions licensed under CC BY-SA 3.0