Rating:
We're given the libc and linker file as well as the binary, first thing i did was to patch it using `pwninit`
When we run it we either get to choose `yay or nay`
Checking the protections enabled on the binary shows this
Ok not much of a protection enabled here, loading it up in IDA here's the main function
So if we choose `yay` the `send_message` function gets called
We see there are two bugs here which are a format string bug & a buffer overflow
The goal is simple, we first use the fsb to leak a libc address then we leverege the overflow to perform a ret2libc
In order to leak libc we can just leak pointers on the stack, but because pie is disabled i just decided to leak it by reading the value of the got of printf
Here's my [exploit](https://github.com/h4ckyou/h4ckyou.github.io/blob/main/posts/ctf/nullcon25/Hateful/solve.py)
Running it on the remote instance works
```
Flag: ENO{W3_4R3_50RRY_TH4T_TH3_M3554G3_W45_N0T_53NT_T0_TH3_R1GHT_3M41L}$
```
Fun fact, during the competition the libc didn't work for me, so i had to leak the got of printf then used a libc [database](https://libc.rip/) to retrieve the right libc being used remotely
