Skip to content

Commit 4763a72

Browse files
committed
Fix broken link in shellcodeme_hard
1 parent 393e5c8 commit 4763a72

File tree

2 files changed

+7
-7
lines changed

2 files changed

+7
-7
lines changed

blaze-ctf-2018/pwn/shellcodeme/sudhackar/README.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -75,12 +75,12 @@ As I noticed that `memset` operation is done on `0x400699`, once the `seen` tabl
7575
7676
Here's how I did it in 7 unique bytes:
7777
78-
* `pop` the saved rip from the stack to a register(rbx) (+1 unique byte)
79-
* `dec` the 32bit variant of that register to make it 0x4006d2 (+2 unique bytes)
80-
* spray the stack by `push`ing the register to setup an already filled `seen` (+1 unique bytes)
81-
* `inc rsp` to align `seen[256]` with 0xd2. will overflow this in the next run (+2 unique bytes)
82-
* `ret` to get input again to the same page (+1 unique bytes)
83-
* input a shellcode such that seen[256] is overflowed back to 0
78+
* `pop` the saved rip from the stack to a register(rbx) (+1 unique byte)
79+
* `dec` the 32bit variant of that register to make it 0x4006d2 (+2 unique bytes)
80+
* spray the stack by `push`ing the register to setup an already filled `seen` (+1 unique bytes)
81+
* `inc rsp` to align `seen[256]` with 0xd2. will overflow this in the next run (+2 unique bytes)
82+
* `ret` to get input again to the same page (+1 unique bytes)
83+
* input a shellcode such that seen[256] is overflowed back to 0
8484
8585
8686
```

blaze-ctf-2018/pwn/shellcodeme_hard/sudhackar/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,4 +35,4 @@ s.close()
3535
```
3636

3737
The random values from the context seldom had 0s. So I sprayed the stack with a register to make `seen` for every character > 0.
38-
Then using the technique from [here](../../shellcode/sudhackar/README.md) to gain code execution.
38+
Then using the technique from [here](../../shellcodeme/sudhackar/README.md) to gain code execution.

0 commit comments

Comments
 (0)