|
BlackBoard:
|
|
|
bufbomb, there is a function
fizz having the following C code:
void fizz(int val)
{
if (val == cookie) {
printf("Fizz!: You called fizz(0x%x)\n", val);
validate(1);
} else
printf("Misfire: You called fizz(0x%x)\n", val);
exit(0);
}
Similar to Level 0, your task is to get bufbomb to execute
the code for fizz when getbuf executes its return
statement, rather than returning to test. In this case, however,
you must make it appear to fizz as if you have passed your
cookie as its argument. You can do this by encoding your cookie in the
appropropriate place within your exploit string.
Some Advice:
fizz — it will
simply execute its code. This has important implications for where on the
stack you want to place your cookie.
Back to the assignment page
