Hot answers tagged

1

Why are you using %00 at the end of your input? You're getting it "free" :) from the code itself in the . ".php" part I'm guessing that the challenge is not in PHP7, since you can't terminate strings like that any more. Anyway, using the payload ../etc/config (without null - %00) works for me: However, maybe my setup is wrong: /opt/lampp/htdocs/project/...


1

Correction.. I’ll look again but in order to overwrite EIP you’d need to input a buffer that is buf +whateverIsAboveItOnStack + EBP (4bytes) + whateverYouWantEIPtoBe . Run the program in gdb and type disass strcpy() the you’ll be able to see where the overflow happens and where your buffers are located. Hope this helps. (gdb) run $(python -c 'print "a" *...


Only top voted, non community-wiki answers of a minimum length are eligible