diff --git a/.gitignore b/.gitignore index e4e5f6c..3783bc3 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -*~ \ No newline at end of file +*~ +solve \ No newline at end of file diff --git a/Week2_Lab2/32Bit_NoALSR/Dockerfile b/Week2_Lab2/32Bit_NoALSR/Dockerfile new file mode 100644 index 0000000..c5727c3 --- /dev/null +++ b/Week2_Lab2/32Bit_NoALSR/Dockerfile @@ -0,0 +1,14 @@ +FROM 6048_builder as ClientBuilder + +ADD ./ret2winOne.c /opt/target.c + +WORKDIR /opt +RUN gcc -m32 /opt/target.c -o /opt/target + + +FROM 6048_server +COPY --from=ClientBuilder /opt/target /home/cueh/target + +CMD ["/tmp/runscript.sh", "/home/cueh/target"] + + diff --git a/Week2_Lab2/32Bit_NoALSR/docker-compose.yaml b/Week2_Lab2/32Bit_NoALSR/docker-compose.yaml new file mode 100644 index 0000000..104bd88 --- /dev/null +++ b/Week2_Lab2/32Bit_NoALSR/docker-compose.yaml @@ -0,0 +1,14 @@ +version: "3.7" + +services: + server: + build: + context: . + ports: + - "1337:1337" + - "22:22" + #cap_add: + # - CAP_SYS_ADMIN + privileged: true + environment: + - RUN_ALSR diff --git a/Week2_Lab2/32Bit_NoALSR/ret2winOne.c b/Week2_Lab2/32Bit_NoALSR/ret2winOne.c new file mode 100644 index 0000000..4415b56 --- /dev/null +++ b/Week2_Lab2/32Bit_NoALSR/ret2winOne.c @@ -0,0 +1,47 @@ +#include +#include +#include +#include + +int INPUT=300; //Give enough to overflow +int BUFFER=150; + +void win(void){ + /*Win Condition + We Want to jump here + */ + printf("\n ===== Win ===== \n\n"); + system("/bin/sh"); //Tradition to get a shell +} + +void lose(void){ + /* Lose Condition */ + printf("Lose :(\n"); +} + +int main(int argc, char* argv[]){ + /* Main Function*/ + char buffer[BUFFER]; + char readBuffer[INPUT]; + + setvbuf(stdout, NULL, _IONBF, 0); + //Pointer to the lose function + void (*fp)(void) = lose; + + printf("--- Overflow the Buffer ---\n"); + printf("Current Memory Address is %p\n",lose); + printf("Aim for %p\n", win); + + printf("What is your input >"); + //fflush(stdout); + fgets(readBuffer, INPUT, stdin); + //Strip newline + readBuffer[strcspn(readBuffer, "\n")] = 0; + printf("You entered >%s<\n", readBuffer); + + memcpy(buffer, readBuffer, strlen(readBuffer)); + printf("Off to %p\n",fp); + fp(); + + return 0; +}