> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/buffer-overflow-0.md).

# Buffer Overflow 0

### Buffer Overflow 0 — PicoCTF Walkthrough | Binary Exploitation

First step is to analyze the source code and identify what actually matters.

### Program Overview

The program does three important things:

1. Reads the flag into memory
2. Takes user input
3. Copies that input into a smaller buffer

There is also a special function:

```c
void sigsegv_handler(int sig) {
  printf("%s\n", flag);
  exit(1);
}
```

This means:

```
If the program crashes → print the flag
```

So here, crashing is not failure — it’s the goal.

***

### Vulnerability

The vulnerable function is:

```c
void vuln(char *input){
  char buf2[16];
  strcpy(buf2, input);
}
```

Key issue:

* `buf2` → only **16 bytes**
* `strcpy()` → copies **without checking size**

So if input > 16 bytes → **buffer overflow**

***

### Input Flow

```c
char buf1[100];
gets(buf1);
vuln(buf1);
```

Two problems here:

* `gets()` → allows unlimited input
* That input is passed into `strcpy()`

So:

```
User → buf1 (large) → buf2 (small) → overflow
```

***

### Exploitation Idea

We don’t need to control execution or do anything complex.

We just need to:

```
Overflow buf2 → corrupt memory → cause crash (SIGSEGV)
```

When crash happens:

```
sigsegv_handler() runs → flag is printed
```

***

### Payload

Any long string works.

Example:

```
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
```

(Anything > 16 bytes is enough)

***

### Steps

1. Run the binary
2. When prompted for input, send a long string
3. Program crashes
4. Flag is printed automatically

***

### Why This Works

* Overflow corrupts stack memory
* Return address becomes invalid
* Program crashes (segmentation fault)
* Signal handler prints the flag

### Key Takeaway

This is a **basic stack buffer overflow** where:

```
You don’t exploit control flow → you exploit the crash itself
```

Sometimes in CTFs, the easiest win condition is:

```
Break the program in the “right” way
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/buffer-overflow-0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.