Mohamed Sayed - Blog

 ( بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ ) (إن أحسنت فمن الله، وإن أسأت فمن نفسي والشيطان) User Management it is a format string challenge, let's start it. First, our menu contains the following after reversing the binary with Ghidra and trying the options we know that there is a Format String in the view description and we can hit it when we create a new user and login with it but to create a user we have to login as admin first and the admin password is random :-). with some static/dynamic analysis, we know that there something weird with the admin login function it reads 21 bytes and it just needs 12 ;-) so we have a trigger here if we check the address (DAT_555555559340) it is close to the address of the password on (DAT_555555559350) and we have an overflow on the first address so we can overwrite the password. When we overwrite the password with the following payload we will get the "strncmp" check for the username and we can get it after logging in with admin we

 ( بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ ) (إن أحسنت فمن الله، وإن أسأت فمن نفسي والشيطان) Table of Content Vector Overflow (100 points) Yawa (109 points) Pac Shell (228 points)

 ( بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ ) (إن أحسنت فمن الله، وإن أسأت فمن نفسي والشيطان) Let's solve Backup Power & Syscalls (pwn). Table of Content Backup Power (pwn - 454) Syscalls (pwn - 398)