$ cat writeup.md…
$ cat writeup.md…
hackthebox
A "robotic bird game" binary that presents a table of 10 bird names, lets you select one by ID, enter a description, and displays it. The binary has three chained vulnerabilities: an out-of-bounds array read for libc leak, an off-by-two buffer overflow that corrupts the stack canary, and a format st
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
A "robotic bird game" binary that presents a table of 10 bird names, lets you select one by ID, enter a description, and displays it. The binary has three chained vulnerabilities: an out-of-bounds array read for libc leak, an off-by-two buffer overflow that corrupts the stack canary, and a format string bug for arbitrary GOT writes.
Remote: nc 154.57.164.77:32657
r0bob1rd — ELF 64-bit LSB executable, x86-64, dynamically linked, not strippedglibc/libc.so.6 — GLIBC 2.31-0ubuntu9.9 (Ubuntu 20.04)glibc/ld.so.2 — Dynamic linker| Property | Value |
|---|---|
| Arch | x86-64 |
| RELRO | Partial (GOT writable) |
| Stack Canary | Enabled |
| NX | Enabled |
| PIE | Disabled (base 0x400000) |
| Stripped | No |
| Libc | GLIBC 2.31-0ubuntu9.9 |
| Symbol | Address |
|---|---|
robobirdNames (array) | 0x6020a0 |
puts@GOT | 0x602020 |
__stack_chk_fail@GOT | 0x602028 |
printf@GOT | 0x602030 |
main | 0x400c0f |
operation | 0x400aca |
pop rdi; ret | 0x400cc3 |
ret | 0x40074e |
...
$ grep --similar