Skip to content
ctfwriteuppwncsaw

CSAW 2013 Exploitation 2 — Point 200

1 min read

The binary receives a buffer and a secret value, each via a separate send, for a total of two sends. As long as the two values are passed in order, RET can be overwritten afterward just like an ordinary stack BOF.

The payload structure is as follows.

Buffer[2048] | secret(4) | SFP | RET