cleaker (Mic Check 10)

pwn_spbctf

Task: NON-PIE x86-64 ELF with a printf(buf) format-string leak followed by a second gets() stack overflow; ASLR is on. Solution: leak _IO_2_1_stdin_ via %3$p to recover libc base, then ret2libc with a single extra ret gadget for 16-byte movaps stack alignment under glibc 2.31.

elf x86-64 ret2libc pwn no-pie format-string remote info-leak stack-alignment aslr-defeat io-stdin-leak movaps glibc-2.31-ubuntu

format_string_leakio_stdin_pointer_leaklibc_base_recoveryret2libcstack_alignment_ret_gadget

$ ls tags/ techniques/

elf x86-64 ret2libc pwn no-pie format-string remote info-leak stack-alignment aslr-defeat io-stdin-leak movaps glibc-2.31-ubuntu

format_string_leakio_stdin_pointer_leaklibc_base_recoveryret2libcstack_alignment_ret_gadget

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[pwn][Pro]inspector the ONE— pwn_spbctf
[pwn][Pro]popa-ot-ropa (Mic Check 10)— pwn_spbctf
[pwn][Pro]look at me (ASLR 10)— pwn_spbctf
[pwn][Pro]Canary leak + ret2win (string_leak)— spbctf
[pwn][Pro]pwn9_mc4 — Mic Check: leak and pwn!— spbctf