Tag Info

New answers tagged


As I understand, you control the input file /tmp/file and this piece of program is run with privileges to read a protected file. Your goal is to read the protected file. I failed to see any issue in this code. The format string is not controlled by the input and the missing line feeds you saw was because the last char of every 20 bytes is being replaced ...


By overwriting printf in the Global Object Table you are, in effect, left with the following code: system(stdout) …which is going to be a problem because stdout points to the stdout FILE structure and this is unlikely to make sense when interpreted as a string. A better chance of success would be to overwrite strlen and pass the command to execute in ...

Top 50 recent answers are included