pwnProeasy

Easy ROP

hackerlab

Task: a 64-bit PIE binary leaks code addresses and then overflows a 0x20-byte stack buffer with fgets(..., 0x4c, ...), while print_flag() is guarded by a global byte. Solution: use the leaks to bypass PIE, set rax=1 with a ROP gadget, write al into is_print_flag, and then call print_flag to print the remote flag.

$ ls tags/ techniques/
stack_overflowpiex86_64ropno_canarynxfull_relroshstkibtleaked_addresses
pie_bypass_via_runtime_leaksrop_register_controlglobal_byte_writeret2win
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups