$ cat writeup.md…
$ cat writeup.md…
broncoctf2026
Task: remote-only pwn with no binary/source; a fixed-size stack buffer sits next to a zero-initialized 'gate' variable guarding the flag. Solution: black-box length fuzzing found the buffer is 76 bytes, so sending 77 'A's overflows into the adjacent gate variable, opening it and printing the flag.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
"I've gotten complaints that BroncoCTF has no PWN. But, I think the more important issue is that our students don't know HOW to PWN! Behold: the PWNTORIAL. This'll solve all your pwn knowledge holes! Google Docs: The Pwntorial ...yeah it's just an AI Slop Google Doc but surely that's enough to educate college students nowadays, right?"
Remote service: nc 0.cloud.chals.io 19476 (also referenced as snicat broncoctf-pwntorial.chals.io).
English summary: A remote-only "tutorial" pwn challenge. No binary and no source were provided, and the linked Google Doc is flavor text. The service reads input into a fixed-size stack buffer that is immediately followed by a zero-initialized "gate" variable guarding the flag. The goal is to overflow the buffer just enough to make the gate variable nonzero.
Recon was entirely black-box:
Plain nc connects but prints no banner and waits for input.
Sending arbitrary data (e.g. hello\n) returns:
[-] Try again. The gate is still closed.
The word "gate" plus the closed/open framing strongly implies a classic adjacent stack-variable overwrite: a fixed buffer followed by a gate (a.k.a. flag guard) variable initialized to zero. An if (gate) check prints the flag once the variable becomes nonzero.
Fuzzing input length with b'A'*n + b'\n' and checking for the success string revealed a clean threshold:
| Input length (n) | Response |
|---|---|
| 73–76 | [-] Try again. The gate is still closed. |
| 77–~256 | [+] SUCCESS! Welcome inside, aspiring pwner! + flag |
| 512 / 1024 | still SUCCESS, but flag sometimes missed in the same read due to timing |
...
$ grep --similar