https://th3b0ywh0l1v3d.github.io/tags/gets/ Recent content in Gets on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/slot-machine/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/slot-machine/ A textbook ret2win: gets() into a 32-byte stack buffer with no canary and no PIE lets us overwrite the saved return address with jackpot(); the only twist is closing stdin to force the menu loop’s EOF break so the corrupted return fires. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/pwning/recipe-for-disaster/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/pwning/recipe-for-disaster/ A food-ordering binary reads chef notes with gets() into a buffer sitting in front of an int price field, letting an overflow set a negative price that makes the order total negative and prints /flag.