# Binary Range
## Challenge 1-4

* Caser FTP buffer overflow exploit
* https://www.exploit-db.com/exploits/16713
* 

## Answer
* Challenge 1:`n`
* Challenge 2:`671`
* Challenge 3:`False`
* Challenge 4:

## Challenge 5-14
* `.125`這台帳密要自己爆

[22][ssh] host: 172.25.120.125   login: admin   password: Pa$$w0rd123


* 
* 

* 開`ghidra`搜尋
* 

* 

* 

* 

## Answer
* Challenge 5:`32`
* Challenge 6:`64`
* Challenge 7:`False`
* Challenge 8:`8681`
* Challenge 9:
* Challenge 10:`Enabled`
* Challenge 11:`Disabled`
* Challenge 12:`Disabled`
* Challenge 13:`32`
* Challenge 14:`32`

## Challenge 15-25

* 找到ssh 開在60000 port
* 
* 
* `student:studentpassword`

nmap -p- -sV -sC -T3 -v -Pn 172.25.120.240

* 

* 

* 

readelf -h rp-lin-x86

* 

* 

* 先找出rbp的位置在`0x7fffffffe580`, 再根據ghidra反編譯的結果得知Canary(local_10)位於rbp - `0x10`, 用gdb算出Canary位置`0x7fffffffe570`
* 
* 

gdb -q one.exe
(gdb) break main
(gdb) r
(gdb) info frame

(gdb) p/x $rbp - 0x10

* 生成pattern後繼續執行程式, crash後看一下之前找到的canary位置現在存放了我們送的payload(0x4141334141644141)再算出字串的偏移量+1得到答案
* 
* 

(gdb) pattern create 120
(gdb) continue
(gdb) AAA%AAsAABAA$AAnAACAA-AA(AADAA;AA)AAEAAaAA0AAFAAbAA1AAGAAcAA2AAHAAdAA3AAIAAeAA4AAJAAfAA5AAKAAgAA6AALAAhAA7AAMAAiAA8AANAA

(gdb) x/gx 0x7fffffffe570
(gdb) pattern offset 0x4141334141644141

* 
* 

## Answer
* Challenge 15:`7.6p1`
* Challenge 16:`Stripped`
* Challenge 17:`ROP`
* Challenge 18:`intel`
* Challenge 19:`52`
* Challenge 20:`False`
* Challenge 21:`64`
* Challenge 22:`65`
* Challenge 23:`Enabled`
* Challenge 24:`INTRANET--BINARIES`
* Challenge 25:`INTRANET-ROOT`