jade/blog
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixup some final pages

Browse source
This commit is contained in:
lf- 2021-03-09 04:32:42 -08:00
parent 94e44e406b
commit 7555f3bbcb
3 changed files with 14 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

18
content/posts/gctf-2020-writeonly.md
View file

@ -157,15 +157,15 @@ the PID since it would have been returned from fork and it is logged by the
suspicious `printf`. As it turned out, it was indeed on the stack, so I wrote
some evil inline assembly to get the value pointed to by `rbp - 0x4`.
The next step was to construct the path. I was unsure of the availability of C
string and `itoa`-like functions in the environment, given that there is no
standard library present, so I just wrote some. An interesting optimization of
this nicked from [later rewriting the exploit in
Rust](https://lfcode.ca/blog/writeonly-in-rust) is that my `itoa` goes
backwards, writing into a with a buffer containing extra slashes that will
otherwise be ignored by the OS. This cut my executable size about in half by
not having to reverse the string or perform string copies as one would have to
do in a normal `itoa`.
The next step was to construct the path. I was unsure of the availability of
C string and `itoa`-like functions in the environment, given that there is no
standard library present, so I just wrote some. An interesting optimization
of this nicked from [later rewriting the exploit in
Rust](/blog/writeonly-in-rust) is that my `itoa` goes backwards, writing into
a with a buffer containing extra slashes that will otherwise be ignored by
the OS. This cut my executable size about in half by not having to reverse
the string or perform string copies as one would have to do in a normal
`itoa`.
```c