Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 213a259

Browse files
committed
Update README.md
1 parent c250fb1 commit 213a259

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

polictf-2015/johns-shuffle/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ John is completely drunk and unable to protect his poor stack.. Fortunately he c
1414
## Recon
1515
The first shot at overflowing by throwing a ton of `A`'s worked. I don't actually know what the vulnerbility was, as I didn't open the binary in IDA.
1616

17-
Once we have control of EIP, and the fact that NX is on, we have to start ROP'ing. Using `pwntools`, We immediately see that we have `system` in our binary, but not the string `/bin/sh`. In order to ROP into `system` we have to have a pointer to the string `/bin/sh`. No worries though, because we also have `read` in our binary.
17+
Once we have control of EIP, and the fact that NX is on, we have to start ROP'ing. Using `pwntools`, we immediately see that we have `system` in our binary, but not the string `/bin/sh`. In order to ROP into `system` we have to have a pointer to the string `/bin/sh`. No worries though, because we also have `read` in our binary.
1818

1919
## Exploit
2020
* Overflow the stack to control EIP.

0 commit comments

Comments
 (0)