Tokyohot N0541 High Quality -

0x603200 - 0x603090 = 0x70 (112) bytes The password buffer is only 0x80 (128) bytes, so we have of headroom before we start overwriting logged_in .

HOST = "127.0.0.1" PORT = 1337 # change to the port the service is bound to tokyohot n0541

struct user char *name; // 8 bytes char *pwd; // 8 bytes ; 0x603200 - 0x603090 = 0x70 (112) bytes The

The challenge is a 64‑bit ELF binary that runs locally on the provided Docker image. It listens on a TCP port (or can be run interactively) and offers a simple menu‑driven interface. The goal is to gain a remote shell (or read the flag) by exploiting a vulnerability in the program. The goal is to gain a remote shell

strcpy(user->pwd, buf); Thus, an overflow of buf can overflow that user->pwd points to! By providing an over‑long password we can write past the allocated 0x80 bytes of pwd and reach the logged_in variable located at 0x603200 (example address).

stack (login): 0x7fffffffe5c0 buf[0x40] The login function does allocate any heap memory; it uses the stack buffer buf . However, after the call to login , the program returns to menu , which later accesses the users array in the global BSS. The overflow in login does not directly touch the global variable – it only corrupts the stack.