-
Notifications
You must be signed in to change notification settings - Fork 0
/
source.c
69 lines (53 loc) · 1.32 KB
/
source.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
// gcc -fno-stack-protector -fpie -pie source.c
#include <stdio.h>
#include <string.h>
typedef struct s_message
{
char msg[140];
char user[40];
int len;
} t_message;
void secret_backdoor()
{
char buffer[128]; // -0x80(%rbp)
fgets(buffer, 128, stdin);
system(buffer);
}
void set_msg(t_message *message)
{
char buffer[1024]; // -0x400(%rbp)
memset(buffer, 0, 1024);
puts(">: Msg @Unix-Dude");
printf(">>: ");
fgets(buffer, 1024, stdin);
strncpy(message->msg, buffer, message->len);
}
void set_username(t_message *message)
{
char buffer[128]; // -0x80(%rbp)
int i; // -0x4(%rbp)
memset(buffer, 0, 128);
puts(">: Enter your username");
printf(">>: ");
fgets(buffer, 128, stdin);
for (i = 0; i <= 40 && buffer[i]; i++)
message->user[i] = buffer[i];
printf(">: Welcome, %s", message->user);
}
void handle_msg()
{
t_message msg; // -0xc0(%rbp)
memset(msg.user, 0, 40); // -0xc0(%rbp) + 0x8c
msg.len = 140; // -0xc(%rbp)
set_username(&msg);
set_msg(&msg);
puts(">: Msg sent!");
}
// slight differences in assembly
int main()
{
puts("--------------------------------------------\n| ~Welcome to l33t-m$n ~ v1337 |\n--------------------------------------------");
// extra eax to 0
handle_msg();
return 0;
}