From 07e81ba0a3628fbef086066da596e2c374f59a32 Mon Sep 17 00:00:00 2001 From: Dvd848 Date: Fri, 4 Jan 2019 21:53:13 +0200 Subject: [PATCH] 35C3 --- 2018_35C3_Junior/arraymaster2.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/2018_35C3_Junior/arraymaster2.md b/2018_35C3_Junior/arraymaster2.md index 3db722d..d4779c4 100644 --- a/2018_35C3_Junior/arraymaster2.md +++ b/2018_35C3_Junior/arraymaster2.md @@ -144,7 +144,7 @@ As you can see, the `command` buffer allocated by `getline` is freed when the pr In our case, the buffer will contain `quit; /bin/sh`, causing the program to quit and then calling `free` (i.e. `system`) on the pointer. `system` won't understand what `quit` means, but it will give us a shell due to `/bin/sh`. -Putting in all together: +Putting it all together: ```python from pwn import * import argparse