Finding libc offset

[acr92]

Hey,

I was wondering if you could expand on how you found the libc base in:

• https://github.com/Caesurus/PicoCTF2017/blob/master/L3_ConfigConsole/exploit.py#L47
• https://github.com/Caesurus/PicoCTF2017/blob/master/L4_flagsay2/exploit.py#L24

Thanks.

[Caesurus]

Sure. The gist of it is that while you're in the debugger you can find the base of Libc. I use Peda or Pwndbg so a simple 'vmmap' command will suffice.

Once you can see the base address of libc, you take the leaked value and subtract the base value to get your offset. That offset will always be the same for that specific libc library.

If I have some time today, i will update the readme.md file to expand on how to find this.

[Caesurus]

@Blystad, I have updated the L3_consoleConfig writeup to outline how I found the libc base address.

Please let me know if that's clear enough or whether I should add more detail. I'll be happy to answer any questions you have.

[acr92]

Thanks, yeah that helped and I was able to solve the challenge :)