Game Of Pwns

Author: NightKing

A 32bit binary has been given.

Decompilation

Looking at the vuln() function..

We see there an scope of an buffer overflow as we can see that the read() function can take an input with a more input length(0x54) than the allocated memory(0x2c).

If we read the challenge description it is pretty clear that we have to find the iron throne. And while decompiling/debugging we see an function.

Aahaa !!

We see that this is called with a parameter which is later checked to a number = which translates as

And then we are supposed to get the flag with

Crafting the exploit

as the required buffer as padding required to reach the eip adding the address of the the parameter of the function and the return address.

The final exploit