Meh, I got to level 4 but didn't go any further.
Learned a lot, but I'm still not sure if there wasn't a much simpler solution that I missed. Was return-to-libc really required to exploit it, or was I trying to kill a fly with a sledge hammer?
Learned a lot, but I'm still not sure if there wasn't a much simpler solution that I missed. Was return-to-libc really required to exploit it, or was I trying to kill a fly with a sledge hammer?
I think I'll try again tomorrow morning and see what I missed.
Also, there's another useful place you can return to that isn't in libc.
ASLR actually makes ret2libc much more difficult to pull off (esp. on 64-bit platforms), because the location of libc.so itself is randomized.