flag
(1)(2)-4077034483e8376c26c5e10a1e2caf6f.png)
There is no source code this time. I downloaded the code and then ran it:
(3)(1)-18360b8fbe812f1b1eb06d5bfcb92d3c.png)
They mention that they use strcpy, which means that the string will be copied from one location to another. This means we might be able to find the string during transit from one register to another. I ran strings on the file to see if there was anything interesting, and I found this:
(1)(2)-04f1c27160687f6921468ded19a668f6.png)
I unpacked the flag file:
(3)-e375f2819df766d1567973c676e09279.png)
I then ran the code with gdb, and made a breakpoint at main. Then I just kept going line by line (by entering "next") until I saw something interesting in the registers:
(4)-162a8a4bca1a04c5ff0bd217bcea1ffb.png)
This had a pwnable.kr flag feel to it, so I entered it, and this was the flag. I want to see if I can get the flag using Cutter as well. You could technically find this by looking through all the strings in the file in Cutter:
(1)(2)-70bb688490e98c221ae210b78a794857.png)