/ CTF / HackTheBox Labs / El Pipo.md
El Pipo.md
 1  Category: #pwn 
 2  Rated Difficulty: #VeryEasy 
 3  Personal Difficulty: #VeryEasy 
 4  
 5  This is a very straight forward question.
 6  
 7  Upon disassembling I realised that I just need to make var_9 into something other than 1 then ill get the flag
 8  
 9  I also then realised that there is read into var_38 which is initialised before var_9 and of size 0x40 which is way bigger than int64_t of var_38. This will then allow me to overwrite the value for var_9 and got the flag
10  
11  Upon reflecting I also realised that I could just inserted 47 characters instead of 0x40 by subtracting the offset of the variables from the base pointer in this case var_38 is at offset -0x38 while var_9 is at offset -0x9 so there is 47 bytes between them