Working through a binary exploitation course posted by RPI a few years ago. Currently on the ASLR lab and having some trouble with it (although not with the parts related to ASLR). I can't figure out how to exploit to begin with, to then deal with the additional complexity of the ASLR bypass.
Heres the code (running on 32 bit Ubuntu):
I would think since they have you compile without the canary that there's an overflow to exploit. Looks like all the sizes are checked correctly except for the one for loop but there's also some weird behavior I don't understand.
Things I do/don't know or have tried:
1. If I write 40 characters to the username, then the for loop overwrites one byte of the message length field.
2. If the username is very long, then part of the tweet field is overwritten and the user input for fgets on line 58 is skipped and the tweet is no longer empty (this is the part I can't seem to understand). In set_tweet, the memory is zeroed at the start anyway, so if there was old data there, how could it not be erased?
3. If I could overwrite more than 1 byte of the message length of the struct, I could transfer more of the large readbuf into tweet and overrun that structure into other memory. Test compilation with 41 instead of 40 in the for loop confirms this.