Overwriting RBP with an Off-by-One Buffer Overflow - Cake - [Intigriti 1337UP LIVE CTF 2022]

[@AidinNaserifard]

Great video! bro😊

[@_CryptoCat]

thanks mate 🥰

[@_techwaves]

wow! great explanation 😍

[@_CryptoCat]

thanks bro 👊

[@davidbillhardt7156]

20:09 You can also define hookpost-stop which will execute after the stop

[@_CryptoCat]

Thanks, that will come in handy!

[@tejaskumar9057]

awesome video!

[@_CryptoCat]

ty 🥰

[@oliverford5367]

Have you ever found a case where you overwrite one byte of a variable higher up on the stack in the same frame?

[@_CryptoCat]

TBH this is the only off-by-one pwn chall I can remember.. Moved away from pwn to web the past year or two xD

[@JoPraveen]

Nice 😄🙌🏻

[@_CryptoCat]

💜💜💜

[@alwan7777]

bro, please discuss the free mechine with hard difficulty on hackthebox😪 it's been two weeks and the machine is not finished

[@_CryptoCat]

Which box is this?? I don't normally do HTB machine walkthroughs because I feel like Ippsec and XCT do such a great job with videos (and 0xdf with the blog writeups)

[@alwan7777]

@@_CryptoCat the name of the machine is oferflow difficult difficulty

[@_CryptoCat]

Ah OK, that one isn't retired yet so public walkthroughs aren't allowed. I haven't done it either xD I would check on the HTB forum or discord for a nudge if you are stuck: discord.gg/hackthebox

[@alwan7777]

@@_CryptoCat oke 🥰thaks

[@heshammahmoud1146]

Can you please explain why you subtract exact 128 byte to get to the shellcode buffer

[@_CryptoCat]

This was a while ago but IIRC the 128 byte offset was identified in GDB. There's some comments in the script as well: github.com/Crypto-Cat/CTF/blob/main/ctf_events/intigriti_22/pwn/cake/exploit.py