in this challenge i have to overwrite RIP register to point to the function "print_flags" which calls "getenv" to get the "FLAGS" variable.
I have overwritten RIP register with the address of "print_flags", but when it is going to call "getenv" i get a SIGSEGV because of the argument passed to getenv which is "AGS" instead of "FLAGS".
What am i doing wrong?
00000000004006a6 <read_all_stdin>:
4006a6: 55 push rbp
4006a7: 48 89 e5 mov rbp,rsp
4006aa: 48 83 ec 20 sub rsp,0x20
4006ae: 48 89 7d e8 mov QWORD PTR [rbp-0x18],rdi
4006b2: c7 45 fc 00 00 00 00 mov DWORD PTR [rbp-0x4],0x0
4006b9: eb 18 jmp 4006d3 <read_all_stdin+0x2d>
4006bb: 8b 45 fc mov eax,DWORD PTR [rbp-0x4]
4006be: 8d 50 01 lea edx,[rax+0x1]
4006c1: 89 55 fc mov DWORD PTR [rbp-0x4],edx
4006c4: 48 63 d0 movsxd rdx,eax
4006c7: 48 8b 45 e8 mov rax,QWORD PTR [rbp-0x18]
4006cb: 48 01 d0 add rax,rdx
4006ce: 8b 55 f8 mov edx,DWORD PTR [rbp-0x8]
4006d1: 88 10 mov BYTE PTR [rax],dl
4006d3: 48 8b 05 86 09 20 00 mov rax,QWORD PTR [rip+0x200986] # 601060 <stdin@@GLIBC_2.2.5>
4006da: 48 89 c7 mov rdi,rax
4006dd: e8 ae fe ff ff call 400590 <fgetc@plt>
4006e2: 89 45 f8 mov DWORD PTR [rbp-0x8],eax
4006e5: 83 7d f8 ff cmp DWORD PTR [rbp-0x8],0xffffffff
4006e9: 75 d0 jne 4006bb <read_all_stdin+0x15>
4006eb: 90 nop
4006ec: c9 leave
4006ed: c3 ret
00000000004006ee <print_flags>:
4006ee: 55 push rbp
4006ef: 48 89 e5 mov rbp,rsp
4006f2: 48 8d 3d 0b 01 00 00 lea rdi,[rip+0x10b] # 400804 <_IO_stdin_used+0x4>
4006f9: e8 52 fe ff ff call 400550 <getenv@plt>
4006fe: 48 89 c7 mov rdi,rax
400701: e8 5a fe ff ff call 400560 <puts@plt>
400706: bf 00 00 00 00 mov edi,0x0
40070b: e8 90 fe ff ff call 4005a0 <exit@plt>
0000000000400710 <main>:
400710: 55 push rbp
400711: 48 89 e5 mov rbp,rsp
400714: 48 83 ec 20 sub rsp,0x20
400718: 48 8d 45 e0 lea rax,[rbp-0x20]
40071c: ba 20 00 00 00 mov edx,0x20
400721: be 00 00 00 00 mov esi,0x0
400726: 48 89 c7 mov rdi,rax
400729: e8 52 fe ff ff call 400580 <memset@plt>
40072e: 48 8d 45 e0 lea rax,[rbp-0x20]
400732: 48 89 c7 mov rdi,rax
400735: e8 6c ff ff ff call 4006a6 <read_all_stdin>
40073a: 48 8d 45 e0 lea rax,[rbp-0x20]
40073e: 0f b6 00 movzx eax,BYTE PTR [rax]
400741: 84 c0 test al,al
400743: 75 0e jne 400753 <main+0x43>
400745: 48 8d 3d be 00 00 00 lea rdi,[rip+0xbe] # 40080a <_IO_stdin_used+0xa>
40074c: e8 0f fe ff ff call 400560 <puts@plt>
400751: eb 18 jmp 40076b <main+0x5b>
400753: 48 8d 45 e0 lea rax,[rbp-0x20]
400757: 48 89 c6 mov rsi,rax
40075a: 48 8d 3d bc 00 00 00 lea rdi,[rip+0xbc] # 40081d <_IO_stdin_used+0x1d>
400761: b8 00 00 00 00 mov eax,0x0
400766: e8 05 fe ff ff call 400570 <printf@plt>
40076b: b8 00 00 00 00 mov eax,0x0
400770: c9 leave
400771: c3 ret
400772: 66 2e 0f 1f 84 00 00 nop WORD PTR cs:[rax+rax*1+0x0]
400779: 00 00 00
40077c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
Here are some screenshots of the payload that i used to and the Segmentation fault error:
UPDATE: Fixing the memory out of bounds, now i get another SIGSEGV:
Stopped reason: SIGSEGV __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120 120 ../sysdeps/x86_64/multiarch/../strlen.S: No such file or directory.
I've read some articles and it might be a NULL terminated string problem or like EOF problem from fgets?
I'm freaking out for this.
