TUCTF 2018: Shella Easy=======================
## Description
Difficulty: easy-ish
Want to be a drive-thru attendant?Well, no one does... But! the best employee receives their very own flag!whatdya say?
`nc 52.15.182.55 12345`
## Solution
The target uses `gets` to read into a stack buffer which is a straightforwardexample of a stack buffer overflow. The target also has an executable stack,which means that we can simply write our shellcode in the buffer, then jump toit by overwriting the saved return address. The binary even prints the addressof the stack buffer we will overflow before asking us for input so this ispretty much as simple as it gets in terms of exploitation.
The only thing that stands between us and a shell is an additional check thatthe target is doing. During initialization one of the stack variables is setto 0xcafebabe but before returning from `main` the target checks if the samevariable is 0xdeadbeef. If this check fails, the target calls `exit`, thus neverreturning (and never executing our shellcode). To make it succeed, we can justoverwrite the variable with the correct value when smashing the stack.
```$ python2 exploit.py[+] Opening connection to 52.15.182.55 on port 12345: Done[*] Switching to interactive mode$ lschalflag$ cat flagTUCTF{1_607_4_fl46_bu7_n0_fr135}$[*] Closed connection to 52.15.182.55 port 12345```