pwnmedium

Abyss

hackthebox

Task: Buffer overflow in cmd_login() with null-terminated copy loop lacking bounds check. Solution: Manipulate loop variable i via self-propagating overflow to overwrite return address with partial address (0x4014ed) that bypasses null byte restrictions, jumping to middle of cmd_read() to read flag file.

$ ls tags/ techniques/
buffer_overflowpartial_overwritenull_byte_bypasscode_reuse
i_variable_manipulationpartial_ret_overwritejump_to_middle_of_function
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]