Vulnhub - Pinky's palace.
Now i'll start doing something different from now on. Instead of presenting the whole solution, i'll write what really learnt about the machine i'm hacking. Cause that's more important for me than just presenting to you the complete write-up, which you can find in every corner of the internet. Much appreciated. Let's start: in this machine, i learn how to find inside the binary it's functions using objdump. But first i look for the strings - and i found execv, which led me to search for functions inside the binary: -d = means disassemble -M = machine architecture After seeing that, i use gdb and breakpoint it in main; i run it, and did disas spawn : I had to confirm if ASRL is enable, it's not. So all address will stay in their places, won't have any changes! So i build a file with that address in the picture above: You need 72 char and the address: Can you see 000055555555447d0? This is the first address of spawn function. Let's run ...
