Flag Vault Walkthrough

Challenge Statement#

Attachment: pwn1.c

Solution#

Analyzing the given code, we see that the login() function calls the print_flag() function upon successful login.
The two local buffers are - char password[100] = ""; and char username[100] = "";

The login() function reads the username input using gets(username), which is vulnerable to buffer overflow.

We also have the credentials given in the code:

So, all we have to do is find the memory layout and overflow the username buffer, which can be used to overwrite the password buffer.
To do this, we can compile the code and build a local executable.

gcc -fno-stack-protector -z execstack -o challenge pwn1.c

Now, we can disassemble the file using the command:

objdump -d challenge > disassembly.txt

From the Assembly Code, we can see that a single buffer is used for both the username and the password.
The username part is from -0xe0 to -0x70 and from -0x70 is the password.

Thus, the username occupies 0xe0 - 0x70 = 0x70 bytes –> 112 bytes. So the payload will be:

python3 -c "print('bytereaper' + '\x00' + 'A'*101 + '5up3rP4zz123Byte')" | nc 10.10.160.254 1337

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.