Snapp admin
Snapp Admin
Solution
At first I ran the program to analyse how does it work, after that realizing that the first input is not vulnerable to overflow, I searched the program for the password that it was asking and reading the assembly code of the program I figured that with correct password ( 9606 ) there is a way to a gets function which allows overflow ( 56 length padding ) to jump inside the is_admin function however there is a condition which can be bypassed easily by just passing the address after the condition which shows the flag.
payload:
b'9606\naaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaa'+p64(0x00401307)
