[peterpeter]

format string vulnerability
printf((int64_t)&var_7ch + 4)

```  
    payload = b"%p." * 21
    io.sendline(payload)
    leaks = io.recvall().split(b".")

    canary = int(leaks[20], 16)
```
Alarm is sure to be used, but I haven't reached it yet, has anyone?

[cavour13]

Found Canary and i m working on the rop!

[Xpwn]

I’m about 80% through solving this challenge, But Stuck .

I followed this write-up `https://pwn-maher.blogspot.com/2020/06/PWN0.html` and replaced `__stack_chk_fail` with main `0x400c0f`
smashing the stack to rerun main, leak libc, and get the canary (`%21$p`) is simple, but overflowing 104 bytes corrupts 2 bytes of the canary.
Brute-forcing isn’t working, my pwntools script is failing, and I get the alarms as expected.
Tried replacing printf with system, but it crashes due to too many printf calls without a proper command.
Pwn isn’t my cup of tea , and my name is just a joke .

```python

offset = 104
main_addr = 0x400c0f
log.info(f"Replacing __stack_chk_fail with main {hex(main_addr)}")
write = { binary.got["__stack_chk_fail"]: main_addr }
payload = fmtstr_payload(8, write)
payload += b"M" * (offset - len(payload) + 1)
p.sendlineafter(b'Select a R0bob1rd > ', b'0')
p.sendlineafter(b'description\n> ', payload)
```

[LiTEE]

I’m about 80% through solving this challenge, But Stuck .

I followed this write-up `https://pwn-maher.blogspot.com/2020/06/PWN0.html` and replaced `__stack_chk_fail` with main `0x400c0f`
smashing the stack to rerun main, leak libc, and get the canary (`%21$p`) is simple, but overflowing 104 bytes corrupts 2 bytes of the canary.
Brute-forcing isn’t working, my pwntools script is failing, and I get the alarms as expected.
Tried replacing printf with system, but it crashes due to too many printf calls without a proper command.
Pwn isn’t my cup of tea , and my name is just a joke .

```python

offset = 104
main_addr = 0x400c0f
log.info(f"Replacing __stack_chk_fail with main {hex(main_addr)}")
write = { binary.got["__stack_chk_fail"]: main_addr }
payload = fmtstr_payload(8, write)
payload += b"M" * (offset - len(payload) + 1)
p.sendlineafter(b'Select a R0bob1rd > ', b'0')
p.sendlineafter(b'description\n> ', payload)
```

The snippet should return to main() but where is libc leak and ret2libc in the second run to continue?

[x1rx]

I’m about 80% through solving this challenge, But Stuck .

I followed this write-up `https://pwn-maher.blogspot.com/2020/06/PWN0.html` and replaced `__stack_chk_fail` with main `0x400c0f`
smashing the stack to rerun main, leak libc, and get the canary (`%21$p`) is simple, but overflowing 104 bytes corrupts 2 bytes of the canary.
Brute-forcing isn’t working, my pwntools script is failing, and I get the alarms as expected.
Tried replacing printf with system, but it crashes due to too many printf calls without a proper command.
Pwn isn’t my cup of tea , and my name is just a joke .

```python

offset = 104
main_addr = 0x400c0f
log.info(f"Replacing __stack_chk_fail with main {hex(main_addr)}")
write = { binary.got["__stack_chk_fail"]: main_addr }
payload = fmtstr_payload(8, write)
payload += b"M" * (offset - len(payload) + 1)
p.sendlineafter(b'Select a R0bob1rd > ', b'0')
p.sendlineafter(b'description\n> ', payload)
```

The snippet should return to main() but where is libc leak and ret2libc in the second run to continue?

there is one more vulnerability apart from format string , out of bound index . you can read something form there for libc

[c137]

Due to the fact that the overflow is 2 bytes, I think a ret2libc is not gonna work, because we can't reach the program counter

[LiTEE]

It's easy fmtstr based challenge. At first the challenge is to create the fmtstr_payload to get libc pointer address leak and overwrite GOT __stack_chk_fail to main() at the same time. Later in the second run to overwrite __stack_chk_fail to for example one_gadget to get shell.

[Steward]

It's easy fmtstr based challenge. At first the challenge is to create the fmtstr_payload to get libc pointer address leak and overwrite GOT __stack_chk_fail to main() at the same time. Later in the second run to overwrite __stack_chk_fail to for example one_gadget to get shell.

does it matter which bird to choose from menu?
libc is different every time we connect the instance and we need to leak it every time right?

[peterpeter]

It seems easy when reading it, and surely it's a simple thing when you see it, but I just can't figure it out. Any hints? Where should I look? What shouldn't be overlooked? Any recommended reading?

[pwns4k3]

It seems easy when reading it, and surely it's a simple thing when you see it, but I just can't figure it out. Any hints? Where should I look? What shouldn't be overlooked? Any recommended reading?

I like that not only leaked flag is enough for you. A few hints:

Just continue creating a payload. I tested your snippet, and it's usable to start with because it successfully triggers __stack_chk_fail and returns to main()
You can add something before "fmtstr_payload" created part to leak the libc pointer address, for example, b'text: %p'  Think of how it affects the "offset" parameter of fmtstr_payload, also "numbwritten" and how the input should be padded.

In the second run, you might find the payload length > 105, but fortunately "write_size" parameter of "fmtstr_payload" helps to avoid manual fmtstr pattern creation.

I would recommend reading https://docs.pwntools.com/en/dev/fmtstr.html