Easy Overflow 2

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: array_overflow, integer_to_string_encoding, little_endian_encoding

Summary

Task: overflow an integer array to overwrite an adjacent string variable from "NOPE" to "YEAH". Solution: provide 7 integers instead of the expected 5, encoding "YEAH" as two integers in little-endian (1493172224 and 4735301) at positions 5 and 6.

Easy Overflow 2 — SPB CTF Pwn Season

Description

"Переполните, чтобы получить флаг" (Overflow to get the flag)

Server: nc 109.233.56.90 11585 Binary: mc5_censored — ELF 64-bit x86-64, not stripped, with debug_info

Analysis

Integer array overflow vulnerability. The program:

1. Asks how many numbers to store (claims max 5, but doesn't enforce)
2. Stores integers in an array at rbp-0x20
3. Has a comparison string "NOPE" at rbp-0x09
4. Checks if the string equals "YEAH" to print the flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

By entering 7 numbers, we overflow the integer array and overwrite the comparison string. The key is encoding "YEAH" as integers:

Enter count: 7
Enter numbers: 0 0 0 0 0 1493172224 4735301

Memory layout:

rbp-0x20: storage[0..4]  <- legitimate array
rbp-0x0c: storage[5]     <- overflow starts
rbp-0x09: comparison     <- "NOPE" -> "YEAH"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍