From 8ce9de0d8d6cfeccfab0502599146481f9f26bb2 Mon Sep 17 00:00:00 2001 From: akrasuski1 Date: Fri, 4 May 2018 00:38:49 +0200 Subject: [PATCH] Update unauthorized.md --- 2018-04-30-rhme3/unauthorized.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/2018-04-30-rhme3/unauthorized.md b/2018-04-30-rhme3/unauthorized.md index ad61152c..845d9562 100644 --- a/2018-04-30-rhme3/unauthorized.md +++ b/2018-04-30-rhme3/unauthorized.md @@ -5,13 +5,15 @@ Notes: -> structure at 0x3001 -> sha256(password) - 0x20 bytes -> address(username) - 2 bytes -> size(username) + 1 - 2 bytes -> username +``` +structure at 0x3001 +sha256(password) - 0x20 bytes +address(username) - 2 bytes +size(username) + 1 - 2 bytes +username +``` -> We can overwrite it, because of unchecked `alloca`. +We can overwrite it, because of unchecked `alloca`. Final code: @@ -55,4 +57,4 @@ def attack(connection): context.log_level = "debug" with serialtube(port = "/dev/ttyUSB0", baudrate = 115200) as connection: attack(connection) -``` \ No newline at end of file +```