I am a cybersecurity student and I was doing an exercise in which I have to access the vip_queue function through a buffer overflow without changing the value of check. I’ve been trying for hours but I haven’t gotten any results. I hope you can help me, thank you. This is the code:
#include <stdio.h>
#include <stdlib.h>
typedef struct {
char name[32];
int check;
} user_data;
void banner() {
puts(" _ _ _ _____");
puts("| \ | (_) ___ ___| ___|__ _ __ _ _ _ __ ___ ___");
puts("| \| | |/ __/ _ \ |_ / _ \| '__| | | | '_ ` _ \/ __|");
puts("| |\ | | (_| __/ _| (_) | | | |_| | | | | | \__ \");
puts("|_| \_|_|\___\___|_| \___/|_| \__,_|_| |_| |_|___/");
puts("nnn");
}
void vip_queue() {
puts("[+] Your user is in the VIP list. Thanks for subscribing :D");
puts("===================================");
puts("===================================");
puts("==== CONGRATULATIONS ====");
puts("===================================");
puts("==== YOU MANAGED ====");
puts("==== TO EXPLOIT THE BINARY ====");
puts("===================================");
puts("===================================");
puts("== STACK BASED BUFFER OVERFLOW ==");
puts("===================================");
puts("===================================");
}
void get_user_info() {
user_data data;
data.check = 0;
puts("[+] Welcome to NiceForums!");
puts("[+] Please, submit your name or alias to continue with the subscription.");
puts("Name or Alias:");
gets(data.name);
if ( data.check != 0 ) {
puts("[!] ALERT! Stop trying strange stuff >:(");
exit(1);
}
return;
}
int main() {
banner();
get_user_info();
puts("[!] There are no places available for non VIP users and you don't figure as one.");
}
i tried:
python2 -c “print 32 * b’A’ + ‘x00x00x00x00x00x00x00x00’ + ‘xa7x11x40x00x00x00x00x00′” > output9.txt
where xa7x11x40x00x00x00x00x00 is the address where the function vip_queue is stored at
and also:
python2 -c “print 36 * b’A’ + ‘xa7x11x40x00x00x00x00x00′” > output8.txt
python2 -c “print 32 * b’A’ + 4 * b’0′ + ‘xa7x11x40x00x00x00x00x00′” > output7.txt
python2 -c “print 32 * b’A’ + ‘x00x00x00x00’ + ‘xa7x11x40x00x00x00x00x00′” > output78
cucaracha is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.