Level 11

About

Another warm up level that covers writing arbitrary values to memory.

OptionSetting
Vulnerability TypeFormat
Position Independent ExecutableNo
Read only relocationsNo
Non-Executable stackYes
Non-Executable heapYes
Address Space Layout RandomisationYes
Source FortificationNo

Source code

#include "../common/common.c"

int target;

void expand_the_input()
{
  char input[256];
  
  target = 0;
  memset(input, 0, sizeof(input));

  fgets(input, sizeof(input)-1, stdin);
  if(strlen(input) == 0) exit(0);

  printf(input);  

  if(target == 0x0ddba11) {
    printf("\n[ critical hit! :> ]\n");
    system("exec /bin/sh");
    exit(0);
  }
}

int main(int argc, char **argv, char **envp)
{
  int fd;
  char *p;

  background_process(NAME, UID, GID);  
  fd = serve_forever(PORT);
  set_io(fd);

  while(1) {
    printf("[ &target = 0x%08x, we want 0x0ddba11, currently is 0x%0x ]\n", &target, target);
    expand_the_input();
  }

}