0wnyou

#eminghuliev NoneCTF

archive disclosure

step-1 *bin300*

(gdb) disas main
Dump of assembler code for function main:
0x080484d0 <main+0>:	lea    0x4(%esp),%ecx
0x080484d4 <main+4>:	and    $0xfffffff0,%esp
0x080484d7 <main+7>:	pushl  -0x4(%ecx)
0x080484da <main+10>:	push   %ebp
0x080484db <main+11>:	mov    %esp,%ebp
0x080484dd <main+13>:	push   %ecx
0x080484de <main+14>:	sub    $0x24,%esp
0x080484e1 <main+17>:	movl   $0x8048559,(%esp)
0x080484e8 <main+24>:	call   0x8048374 <getenv@plt>
0x080484ed <main+29>:	mov    %eax,-0x8(%ebp)
0x080484f0 <main+32>:	movl   $0x804855e,0x4(%esp)
0x080484f8 <main+40>:	lea    -0xe(%ebp),%eax
0x080484fb <main+43>:	mov    %eax,(%esp)
0x080484fe <main+46>:	call   0x8048394 <strcmp@plt>
0x08048503 <main+51>:	test   %eax,%eax
0x08048505 <main+53>:	jne    0x8048513 <main+67>
0x08048507 <main+55>:	movl   $0x8048564,(%esp)
0x0804850e <main+62>:	call   0x8048344 <printf@plt>
0x08048513 <main+67>:	add    $0x24,%esp
0x08048516 <main+70>:	pop    %ecx
0x08048517 <main+71>:	pop    %ebp
0x08048518 <main+72>:	lea    -0x4(%ecx),%esp
0x0804851b <main+75>:	ret
0x0804851c <main+76>:	nop
0x0804851d <main+77>:	nop
0x0804851e <main+78>:	nop
0x0804851f <main+79>:	nop
End of assembler dump.

== > section

0x08048507 <main+55>:	movl   $0x8048564,(%esp) ===> move data stack pointer and check adress
0x0804850e <main+62>:	call   0x8048344 <printf@plt> <----- call printf function :)

Examine the variable as a string

(gdb) x/s 0x8048564
0x8048564 <.rodata+12>:	 "Flag: az4d1f2g6g8r"