Untitled

This binary are 64 bit executable.

Untitled

I check the binary security using checksec

Untitled

And here's the look when executing the binary

Untitled

It leaking some address. If we decompile it, we can see if it leaking user input's address.

Untitled

The program also vulnerable to buffer overflow attack on the second input.

Untitled

Because NX protection was disabled, we can execute shellcode on the binary.

We need to find the address of our inputted string which are leaked on the program, then we need to find the exact buffer to overwriting the return address. After that we should find for appropriate shellcode and combine those all to gaining shell on the system.

You can use shellcode from this site

http://shell-storm.org/shellcode/files/shellcode-806.php