ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Mind the Gap

Easy 15 pts

Before you can overwrite a return address you have to know exactly how far away it is. The stack layout below is from a vulnerable function. Work out the offset in bytes from the start of the input buffer to the saved return address — the number of bytes of padding before your overwrite begins. The flag is nm{offset_<that number>}.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

You need to fill the buffer, then the saved frame pointer, before you reach the return address.

Hint 2

buf is 64 bytes; the saved frame pointer (RBP) is 8 bytes on x86-64.

Hint 3

64 + 8 = 72. The flag is nm{offset_72}.

The artifact

; vulnerable_fn stack frame (x86-64)
  [rbp-0x40]  char buf[64]      <- gets(buf) writes here, upward
  [rbp+0x00]  saved rbp  (8)
  [rbp+0x08]  saved return addr <- goal

  offset(buf -> return addr) = 64 + 8 = ?

Flag format: nm{offset_N} where N is that byte count.

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.