# LOGBOOK 6

## TASK 1

In order to crash the program running in the docker container we send a message with the `%s` formatter. By doing `echo %s` the program will print the memory address in string format, but has the memory address can't be converted into a string the program crashes, as we can see because it didn't print:` (^_^)(^_^) Returned properly (^_^)(^_^)`.


## TASK 2.A

To discover how many %x we need for the server to print out our input we sent a mesage composed of `@@@@` and many `%x`. We chose `@@@@` because it's easy to recognize in hexadecimal as `40404040`. We discovered our input in the 64th position of the server output.


## TASK 2.B

In order to print out the secret message, we modified build_string.py to build our message. The message has the adress of the secret message, taking into account little-endian adresses, followed by 63 `%x` and a `%s` to print the message. In the server container we see that the secret message is `A secret message`.



## TASK 3.A
The original value of the target is 0x11223344.
The `%n` formatter assigns a variable the count of the number of characters used in the print statement before the occurrence of it.
So we make a badfile similar to the previous task, with the adress of the target variable and a `%n` as the 64th format identifier.
This changes the variable's value to 0x000000ef.

## TASK 3.B

Since the `%n` assigns a variable the count of the number of characters used in the print, we need to add more bytes before so the value reaches 0x5000.
Since 0x5000 is 20480 in decimal we needed to add 20247 more `%x`'s .
After changing the python script and sending the new message, the variable's value changed to 0x5000.


# CTF - Week 7
- Running the checksec on the program we get the following informations:

RELRO           STACK CANARY      NX            PIE  
Partial RELRO   Canary found      NX enabled    No PIE 

- So the program has a canary which can difficult stack smashing attacks.
- The NX is enabled so so it works with the processor to help prevent buffer overflow attacks by blocking code execution from memory that is marked as non-executable.
- PIE is disabled so the program and files are always on the same memory position in every run which means we can locate them easily.

Answering the questions:
- The line of code with `printf(buffer);` can be exploited by the fact that they don't especify the format strings needed to print the buffer, which means we can print the content how we want to, to get to the flag.
- The flag is loaded into the memory so it can be accessed by with string formatters as `%s` which copies the address content of the flag to the output.

- By debbuging the program we got the following output:


- So the flag address is 0x804c060 in every execution
- So by changing the program


-Running the proram the output is:


# Challenge 2

- After running checkseck I got the following results:

    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000) 

- Which are the same ones of the previous challenge.
- Also the vulnerable line is the same: `printf(buffer)` without the formatting strings.
- This time the flag.txt is not loaded into memory but we can access it by typing `cat flag.txt` in the shell called by the system inside the if statement that prints "Backdoor activated"
- To reach that we have to find the address corresponding to the key and change its value


- By debbuging the program like we did before we now know the address of the key which is `0x804c034` and in the little-endian format the address is `\x34\xc0\x04\x08`.

- We need to change the key value to `0xbeef` which is `48879` bytes in decimal by reaching the key address position with that value before we use `%n` to change its value and open the shell containing the flag file where we can use `cat flag.txt`.

- Using the exploit program from the challenge 1 and making a few changes we can change the program so it writes the output in the terminal. The program will receive until "..." and then send the line.
- The buffer is 4 bytes up the stack so we added the string "aaaa" before inserting the address of the key address. The address is 4 bytes long
- After that since we already added 8 bytes instead of adding `48879` bytes to get the address `0xbeef`, we add `48871` bytes and only then we use the `%n` to change the value of the key and access the shell.


- After running the program the new shell opens as we can see by the "Backdoor activated" output and then we can see the flag.txt file.