Last night I was watching a interesting presentation from 0xff about Security applications of language technology and the sponsors were inviting people to compete on the CTF.
The level two had a interesting challenge: with a user input for login, can you access the flag, which as a variable inside that function?
The code looks like this
And the trouble is spotted when we compile this code:
So, let’s start trying to search the addresses available, for this we need to send the caracter %x:
Now, let’s try to get the values from another format string: