ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / Stack Buffer Overflows / ret2win

ret2win

Medium 40 pts

The canonical first pwn: a binary with a win() function that is never called and a gets() that lets you overwrite the return address to call it anyway. You will get the binary, find the offset for real, and send a payload that redirects execution to win(). Needs the sandboxed process runner, which is the next pwn piece.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

This lab is being built — it needs a sandbox to run your payload against safely.

Hint 2

When it lands: find the offset with a cyclic pattern, then overwrite the return address with &win.

Interactive lab — building

This one needs a live sandbox and is being wired up. The brief and hints describe exactly what it will do; the theory lessons in this track are the on-ramp.