TryOverFlowMe1 — Simple Buffer Overflow (port 9003)

Summary

First challenge in the TryPwnMeOne room. A netcat-like service on port 9003 asks for a "comment". By simply sending a long string, you overflow the buffer on the stack and get the flag directly — no precise offset calculation or specific value needed.

Recon

nmap -sV -sC -p 9003 <target-ip>

The service shows a banner and the text:

Please go ahead and leave a comment :

This kind of service (reading input without clear validation) is a typical signal for a classic stack-based buffer overflow.

Exploitation

Simply sending a long string of As to the service was enough to overflow the buffer and get the flag:

python3 -c "print('A'*300)" | nc <target-ip> 9003

Or interactively:

nc <target-ip> 9003
# paste a long string of e.g. 200-300 A's

Why this works

The underlying cause is (as in the follow-up challenges) the use of an unsafe input function such as gets(), which does no length check on the input relative to the buffer size. As soon as the buffer overflows, adjacent stack memory is overwritten. In this first, simpler version of the challenge there's apparently no specific value to match (as there is in TryOverFlowMe2) — an overflow by itself is enough to break the intended control flow (e.g. a guard variable that gets overwritten by accident) and land at the flag function.

Next step

See 02-tryoverflowme2-writeup.md for the harder variant, where a specific variable (admin) must be overwritten with an exact value.