Overwriting return address of main function

Question

I am new to CTFs and I was asked to solve this:

#include <cstdio>

// g++ pwn2.cpp -o pwn2 -static

void ilocamp() {
     char flaga[1024] = {0};
     FILE *f = fopen("flag2.txt", "r");
     fread(flaga, 1, 1024, f);
     fclose(f);
     printf("flaga: ILOCAMP{%s}\n", flaga);
}


int main() {

     int tab[100] = {0};
     int dwa = 2;
     int n,i,min,x;

     scanf("%d",&n);
     for (i=0;i<n;i++) {
        scanf("%d", &x);
        scanf("%d", &tab[x]);
     }

     min = 1000000000;
     for (i=0;i<n;i++) {
        if (tab[i] && tab[i] < min) {
           min = tab[i];
        }
     }

     printf("najmniejsza liczba: %d a dwa wynosi: %d\n", min, dwa);
}

I know, that the point is to overwrite return address of main function with ilocamp() entry address, and to do this I am supposed to use that simple vuln in the loop, but I just have no clue how to do this. I have binary also, tried to do something with gdb but I dont know in true how to. Can you give me some tips? There is binary: http://www48.zippyshare.com/v/b7OaWQeW/file.html (File "flag2.txt" is on local server)

Answer 1

Just a rough description for now as I don't have much time. The general idea is to determine the address of the target function as well as the exact position of the return address on your stack.

If you want to overwrite the return address you first need to find the correct position. To do so you will probably want to debug the program, set a breakpoint to the last possible step in your main function and watch the registers change by stepping single instructions from there. A brief hint: If you open the program and subsequently put a 1 Byte longer string into it every time it launches: you can watch it crash at some point. Assuming there is no stack canary or shadow stack or whatsoever you will have found your target address. You could (while debugging it) e.g. feed it a lot of 'A's and watch for 0x41 in your Debugger.

Next thing is to determine the address of your target function. Its pretty straight forward, you can e.g. try info symbol with info address. After that it all comes down to (in the easiest case) writing garbage (e.g. 'A') on the stack until you reach the adress of the RIP (Return Instruction Pointer) and then write the new adress you want into it.

Also do read a little about EIP/RIP, and Stack Overflow on wikipedia and others.