[picoCTF] heap 0

OVERVIEW

challenge link - https://play.picoctf.org/practice/challenge/438
difficulty level - easy

SOLUTION

so to solve this ctf we get

binary file of the program
source code of the program
connection to the remote instance

after examining the source code i see that the program allocates two variables input_data and safe_var

to get the flag we somehow need to change the value of safe_var from "bico" to something else
snippet of the check_win function

void check_win() {
    if (strcmp(safe_var, "bico") != 0) {
        printf("\nYOU WIN\n");

        // Print flag
        char buf[FLAGSIZE_MAX];
        FILE *fd = fopen("flag.txt", "r");
        fgets(buf, FLAGSIZE_MAX, fd);
        printf("%s\n", buf);
        fflush(stdout);

        exit(0);
    } else {
        printf("Looks like everything is still secure!\n");
        printf("\nNo flage for you :(\n");
        fflush(stdout);
    }
}

exploring further i found this

void write_buffer() {
    printf("Data for buffer: ");
    fflush(stdout);
    scanf("%s", input_data);
}

this is a huge security flaw as the input is not sanitized and we can overflow the input_data buffer allowing us to overwrite the adjacent memory locations including safe_var

to determine the exact string length required to overwrite safe_var i analyzed the memory layout of the program

Heap State:
+-------------+----------------+
[] Address -> Heap Data
+-------------+----------------+
[] 0x62dd9d4312b0 -> pico
+-------------+----------------+
[*] 0x62dd9d4312d0 -> bico
+-------------+----------------+

these are hex numbers so to find the difference between them we can use a online hex calculator