'I am doing a Stack-Based Overflow and having a hard time figuring out how to overflow it exactly the right amount

I am doing my university cybersec website because I want to get better at it and right now I'm working on a challenge that involves having to connect to a server, which promps me for input using C's gets() function. I was given a .elf file that I was able to decompile.assembly code After viewing the assembly code, I am pretty sure that I am supposed to replace $0xcafebabe which is in ebp-0x10 with $0xdeadbeef, because of the jne later on that will not let me progress to giveflag when deadbeef is not equal to whatever is in ebp - 0x10. The gets() function is insecure and I think I am supposed to overflow the stack in order to change ebp - 0x10 to cafebabe, the only issue I'm having is that I am not too sure if my math is correct.

I was pretty sure that func08048410 is the gets() function call, and it stores the result of that into ebp - 0x30. So, I assumed that I could do 0x30 - 0x10 to see exactly how much I need to overflow before overwriting the value at ebp - 0x10 to be deadbeef. The server detects when I'm overflowing and tells me, so I trial and error'd my way through it until I found that the max length of my input is supposed to be 36 characters long. Then I added 32 (68 characters total) more characters to overflow it 32 bytes, then added different variations of deadbeef. It's running on intel so I assumed it was little-endian so I tried efbeadde instead, I tried /xef/xbe/xad/de, I tried /0xef/0xbe/0xad/0xde, and I also tried doing extended ascii values (∩╛¡▐) to see if that would work and nothing has worked so far. I am pretty lost and it's been a while since ive done assembly so I feel like im missing something important! I dont post here too often so sorry if the formatting is incorrect somewhere!



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source