pwneasy

Easy ROP

hackerlab

Task: a 64-bit PIE binary leaks code addresses and then overflows a 0x20-byte stack buffer with fgets(..., 0x4c, ...), while print_flag() is guarded by a global byte. Solution: use the leaks to bypass PIE, set rax=1 with a ROP gadget, write al into is_print_flag, and then call print_flag to print the remote flag.

$ ls tags/ techniques/
stack_overflowpiex86_64ropno_canarynxfull_relroshstkibtleaked_addresses
ret2winpie_bypass_via_runtime_leaksrop_register_controlglobal_byte_write
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]