TUCTF 2018: Timber==================
## Description
Difficulty: easyAre you a single lumberjack tired of striking out? Well notwith Timber! Our deep learning neural network is sure to find a perfect matchfor you. Try Timber today!
`nc 18.222.250.47 12345`
## Solution
The interesting functions in the target are `doStuff` which displays theinterface, and `date` which prints the flag.
By looking at the disassembly of `doStuff` we can see that the second call to`printf` uses a user-controlled format string which we can exploit to read andwrite arbitrary memory.
![doStuff](img1.png)
The binary is compiled with partial RELRO, which means that the GOT entries arewritable. The easiest way to get the flag is to overwrite the GOT entry for`puts` with the address of `date`. This way the call to `puts` will insteadexecute `date` and give us the flag.
Pwntools has a useful helper for generating format string exploits but it needsto know which is the first format argument that we can control. The easiest wayto find out is to try `%s`, then `%x%s` and so on until the target crashes.  Inthis case `%x%s` crashes the target which means that we control the argumentsstarting from the second.
```$ python2 exploit.py[+] Opening connection to 18.222.250.47 on port 12345: DoneTUCTF{wh0_64v3_y0u_7h47_c4n4ry}
[*] Closed connection to 18.222.250.47 port 12345```