I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /home/start/flag (with "start" being the name of the binary file).

Obviously, this directory does not exist in my filesystem. So my questions are:

  • Why is there a virtual home directory for the process?
  • How did the program manage to "put" files into this directory?

The process of spawning a shell and cd-ing into the virtual home directory (which appears to exist) can be seen here: https://sreelakshmip.wordpress.com/2017/06/05/write-up-start-pwnable-tw/

  • That writeup shows them running the exploit against the challenge server, where I'm sure that directory actually exists. Why do you think otherwise? – multithr3at3d Jan 29 '20 at 22:19
  • To be honest, I did not realize that the exploit is run against the server. I feel very, very stupid. Thanks for clearing it up to me! – Sam Jan 29 '20 at 22:31
  • no problem, welcome to the site! – multithr3at3d Jan 30 '20 at 1:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.