diff --git a/simple-rop/Makefile b/simple-rop/Makefile new file mode 100644 index 0000000..96f2342 --- /dev/null +++ b/simple-rop/Makefile @@ -0,0 +1,2 @@ +(all): + gcc -m32 -o simple-rop -fno-stack-protector -O0 simple-rop.c \ No newline at end of file diff --git a/simple-rop/description.md b/simple-rop/description.md new file mode 100644 index 0000000..feda140 --- /dev/null +++ b/simple-rop/description.md @@ -0,0 +1,3 @@ +On the shell there is a folder ``. +Read flag.txt +[Source](${simple-rop.c}) \ No newline at end of file diff --git a/simple-rop/flag.txt b/simple-rop/flag.txt new file mode 100644 index 0000000..43e31ae --- /dev/null +++ b/simple-rop/flag.txt @@ -0,0 +1 @@ +easyctf{r0p_7o_v1ct0ry} \ No newline at end of file diff --git a/simple-rop/grader.py b/simple-rop/grader.py new file mode 100644 index 0000000..31e162c --- /dev/null +++ b/simple-rop/grader.py @@ -0,0 +1,4 @@ +def grade(random, key): + if key.find("r0p_7o_v1ct0ry") != -1: + return True, "Correct!" + return False, "Nope." diff --git a/simple-rop/problem.yml b/simple-rop/problem.yml new file mode 100644 index 0000000..14f06a3 --- /dev/null +++ b/simple-rop/problem.yml @@ -0,0 +1,7 @@ +title: Simple Rop +category: Binary Exploitation +value: 75 +author: r3ndom +autogen: false +files: + - simple-rop.c diff --git a/simple-rop/simple-rop.c b/simple-rop/simple-rop.c new file mode 100644 index 0000000..f3c33e3 --- /dev/null +++ b/simple-rop/simple-rop.c @@ -0,0 +1,25 @@ +#include +#include + +void print_flag(); +void what_did_you_say(); + +int main(int argc, char* argv[]) +{ + gid_t gid = getegid(); + setresgid(gid, gid, gid); + what_did_you_say(); + return 0; +} + +void print_flag() +{ + system("cat flag.txt"); +} + +void what_did_you_say() +{ + char buff[64]; + gets(buff); + printf("You said: %s\n", buff); +}