Cusco
Last updated
Last updated
This time, the main
function only calls the login function.
Let's set a breakpoint at the login
function.
Once inside the login
function, we can see that it asks the user to input the password and then jumps based on whether the password is correct.
Let's set a breakpoint right before the function returns.
While examining our input in memory, we can see something interesting.
As we can see the stack pointer sp
now points to the beginning of our input.
Let's step once to the ret
instruction using the s
command.
The stack pointer now points at the location 16 bytes after the start of the buffer because the add 0x10, sp
instruction just got executed.
When the the ret
instruction executes, the the bytes pointed to by the sp
is treated as the return address.
This looks like the start of another buffer overflow attack. What if we overwrite that address with something that we want to execute.
Look! there's an unlock_door
function at 0x4446
. This is something we would really like to execute.
Let's reset
the program and this time provide an input of 18 bytes. (The program says we can only enter 8 - 16 bytes but it never checks.)
Note that the last two bytes are reversed, this is because LSB is stored leftmost and MSB is stored rightmost. This is also known as little-endian format.
The program will interpret these bytes as 4446
.
Let's hit c
to continue the program.
Looks like LockIT hasn't improved their security all that much.