$ cat writeup.md…
$ cat writeup.md…
broncoctf2026
Task: x86-64 ELF banking simulator; reach a $1,000,000 balance to buy the flag despite deposit caps. Solution: chain an INT_MIN abs()/cmovns bug in Dispute (INT_MIN passes a signed <=999999 upper-bound check and is added to balance, making it hugely negative) with a signed/unsigned comparison bug in Buy Flag (signed negative balance is reinterpreted by an unsigned jbe as a value > 999999), so win() prints the flag.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
"Your account starts at $100. The flag costs $1,000,000. Deposits are capped. Withdrawals can't go below zero. No strings attached. We don't even need to guard the vault. This bank is impenetrable!"
A Linux ELF binary named
bankwas provided.
English summary: A menu-driven "banking" ELF starts you with a $100 balance.
The flag costs $1,000,000, deposits are capped at 3 transactions of $10,000
(max legitimate balance ~$30,100), and withdrawals are guarded against going
negative. All input is numeric (integer scanf — "no strings attached", so no
format-string / NaN tricks). The goal is to reach a balance that satisfies the
"Buy Flag" check and call win(). This is a pure business-logic / signed-integer
challenge: two integer bugs are chained.
file bank:
ELF 64-bit LSB, x86-64, dynamically linked, GCC (Ubuntu 11.4.0) 11.4.0, NOT stripped
SHA256: d5ba54ab23cdbe05c9d0a782295e7515009e0078ff6fedf6a124ae9cb579b00a
checksec: Partial RELRO, No canary, No PIE (base 0x400000),
SHSTK/IBT enabled. NX status is irrelevant here — no memory corruption is used.
nm / symbols (not stripped):
main @ 0x401223win @ 0x4011d6 — prints [!] TRANSACTION APPROVED and the flagflush_stdin @ 0x4011ffstrings reveals the embedded flag bronco{REDACTED} living in
.rodata, printed only from win(). So this is a ret2win-style goal, but
reached purely through the program's own control flow (call win), not via a
stack overwrite.
main, signed 32-bit unless noted)| Variable | Slot | Init |
|---|---|---|
balance | [rbp-4] | 100 (0x64) |
dispute_used | [rbp-8] | 0 |
deposits_remaining | [rbp-0xc] | 3 |
Menu:
...
$ grep --similar