Skip to content

Commit d087adb

Browse files
committed
fixed typo in shitsco
1 parent 54dec35 commit d087adb

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

Diff for: _posts/2014-05-19-defcon-2014-quals--shitsco.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ Enable seems not too exciting, though it does appear to set an admin bit.
6969

7070
Notably, their read_input function doesn't properly null terminate strings, so sometimes we can get a few bytes of stack data out of the %s on printf. Unfortunately, this turns out to be completely worthless.
7171

72-
[addendum] I later realized that this IS useful, I knew I was reading the result of strcmp, but was lazy and didn't think about the fact that strcmp tells you WHERE the difference starts, so you can trivially brute force the password only 1 character at a time. This would've also worked.
72+
I later realized that this IS useful, I knew I was reading the result of strcmp, but was lazy and didn't think about the fact that strcmp tells you WHERE the difference starts, so you can trivially brute force the password only 1 character at a time. This would've also worked.
7373

7474
On to the other odd looking features of 'set' and 'show'.
7575

@@ -154,7 +154,8 @@ Lets cook up a better name then, say one that has the same structure as a struct
154154
### Reading something
155155

156156
Well now that we have a read, lets go back to enable, and find something to read.
157-
.text:08049267 mov [esp+4Ch+buffer], ebx ; s2
157+
158+
.text:08049267 mov [esp+4Ch+buffer], ebx ; s2
158159
.text:0804926B mov [esp+4Ch+stream], offset dword_804C3A0 ; s1
159160
.text:08049272 call _strcmp
160161
.text:08049277 mov [esp+4Ch+var_14], eax

0 commit comments

Comments
 (0)