Level 1: Plato (10 pts)
Within the filebufbomb
, there is a function
fizz
having the following C code:
void fizz(int val) { if (val == cookie) { printf("Fizz!: You called fizz(0x%x)\n", val); validate(1); } else printf("Misfire: You called fizz(0x%x)\n", val); exit(0); }Similar to Level 0, your task is to get
bufbomb
to execute
the code for fizz
when getbuf
executes its return
statement, rather than returning to test
. In this case, however,
you must make it appear to fizz
as if you have passed your
cookie as its argument. You can do this by encoding your cookie in the
appropropriate place within your exploit string.
Some Advice:
-
Note that the program won’t really call
fizz
— it will simply execute its code. This has important implications for where on the stack you want to place your cookie.