This is the second challenge in the P0wn3d series. Since it is very similar to the previous one, I won’t go into details. I’ll leave the link to the previous challenge as it contains all the useful explanations for solving this one: P0wn3d. In this challenge, there are simply two guards instead of one.
🔬 Vulnerability Analysis
Potential Vulnerabilities
Buffer Overflow
🎯 Solution Path
Exploitation Steps
Exploitation
I simply added to the script from the previous challenge the sending of 0xdeadbeef (first guard) instead of 0x42424242. Then, I added the sending of the second guard 0x0badc0de since there is a logical AND in the if statement:
So, the payload will look like this: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + sending 0xdeadbeef + 0x0badc0de. With the first part, I fill the buf buffer, and then I insert the bytes to fill guard1 and guard2, making the if condition true and calling the get_flag() function, which prints the flag.
🛠️ Exploitation Process
Approach
The automatic exploit is identical to the one from the previous challenge, except now there are two guards, so it sends 0xdeadbeef to pass the first guard and 0x0badc0de for the second guard.
