n30m1nd / linux_heap_exploitation_intro_series Goto Github PK

Attention: SPOILER

Thank you @n30m1nd for sharing these UAF examples.
Tho goal in the challenge is to get the "SP{nottheflag_d000000000000000000d}" string when pressing 4, right?

My approach:
Run the server locally and connect with "netcat localhost port".
[...]
Then I wanted to set contents of a new allocated chunk by pressing 3.
I had problems sending the raw bytes (e.g. 563547cd46e8) back to the server.

So I changed your code:

//case 3 
		/*...*/				
//if (recv(clientfd, buffer, 8, 0) > 0)
if (recv(clientfd, buffer, 16, 0) > 0){
    long c = strtol(buffer,NULL,16);
    memcpy(strchunks[chunkpos], &c, 8 );
    //memmcpy(strchunks[chunkpos], (char*)buffer, 8);
    } 
send(clientfd, memcpymessage, strlen(memcpymessage), 0);

This leads to success (if success is really the return of the flag string).

Question: Is there some other way to send these bytes? What is your solution?