Skip to content
Permalink
Browse files
First Ret2Win Added
  • Loading branch information
aa9863 committed Jan 23, 2023
1 parent 5038782 commit 6355edc56ac00393a41df52996ea6f24b51411b1
Show file tree
Hide file tree
Showing 2 changed files with 56 additions and 0 deletions.
@@ -0,0 +1,13 @@
# Build the first overflow target

CC = gcc
CFLAGS = -m32 -g -z execstack


ret2winOne: ret2winOne.c

$(CC) $(CFLAGS) ret2winOne.c -o ret2winOne


all: ret2winOne

@@ -0,0 +1,43 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int BUFFER=150;

void win(void){
/*Win Condition
We Want to jump here
*/
printf("\n ===== Win ===== \n\n");
system("/bin/sh"); //Tradition to get a shell
}

void lose(void){
/* Lose Condition */
printf("Current Memory Address is %p\n",lose);
printf("Aim for %p\n", win);
printf("Lose :(\n");
}

int main(int argc, char* argv[]){
/* Main Function*/

//Pointer to the lose function
void (*fp)(void) = lose;

char buffer[BUFFER];
printf("Overflow the Buffer\n");

if (argc != 2){
printf("Overflow the buffer\n");
printf("Hint! Try `python -c \"print 'A'*100\"`\n");
return -1;
}

memcpy(buffer, argv[1], strlen(argv[1]));
printf("Off to %p\n",fp);
fp();

return 0;
}

0 comments on commit 6355edc

Please sign in to comment.