Tie-In to Lab 2
- You will be given a vulnerable 64-bit binary containing a hidden
win()-style function. - Tasks:
- Identify the unbounded copy in the source / disassembly.
- Find the offset to the saved return address (cyclic pattern).
- Build
padding + p64(win); add aretgadget ifmovapscomplains. - Capture the flag, then write the fix: replace the unsafe call and re-test.
- Deliverable includes both the working exploit and the patched, non-vulnerable version.
Key Takeaway
You have not understood the bug until you can both trigger it and eliminate it.