> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/local-target.md).

# Local Target

The goal of this challenge is to manipulate the value of a local variable `num` to equal **65**. The program takes user input but does not appear to provide a direct way to change `num`.

### **Vulnerability: Stack-Based Buffer Overflow**

By analyzing the source code (or through manual fuzzing), we identify a **buffer overflow** vulnerability. The program allocates a specific amount of memory for our input string on the **stack**. In C, local variables are often placed next to each other in memory.

If the program uses a function like `gets()` or `scanf()` without length checks, we can provide more data than the buffer can hold. The "extra" data spills out of the buffer and overwrites whatever is next to it—in this case, the `num` variable.

### **Exploitation Strategy**

#### **1. Finding the Offset**

To change `num` to exactly 65, we first need to know how many "junk" characters are required to fill the buffer before we reach the memory address of `num`.

* In your first attempt, you entered **32 'A's**. The result was `num is 1094795585`.
* In hex, `1094795585` is `0x41414141`. This proved that 32 characters were far too many, as they completely overwrote `num` with four 'A's.

#### **2. Crafting the Payload**

Through testing, the offset was determined to be **24 characters**.

* **Buffer Padding:** `123456789123456789123456` (24 bytes)
* **Target Value:** `A` (The 25th byte)

In the ASCII table, the character **'A'** has a decimal value of **65**.

### **Execution**

When we send the payload, the stack looks like this:

| Memory Address         | Data (Hex)    | Purpose                                |
| ---------------------- | ------------- | -------------------------------------- |
| `0x...00` to `0x...17` | `31 32 33...` | 24-byte Buffer (Junk)                  |
| **`0x...18`**          | **`41`**      | **Variable `num` (Overwritten to 65)** |

#### **Command:**

```bash
nc saturn.picoctf.net 54133
Enter a string: 123456789123456789123456A
```

#### **Result:**

The program sees `num == 65`, satisfies the `if` condition, and prints the flag: **`picoCTF{l0c4l5_1n_5c0p3_ee58441a}`**

#### **Why it works (The "Why")**

This works because of the lack of **bounds checking**. The program trusts that the user will only enter a short string. By violating that trust, we gain control over the program's execution flow and internal state. In a real-world scenario, this same technique could be used to overwrite return addresses to hijack the entire computer.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/local-target.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.