Guard Post — avitoctf

Description

Пчёлы обнаружили пропажу мёда и улучшили систему входа и выхода из улья. Теперь каждого аттестует обученный шершень-охранник. Докажите, что вы не робот, не верблюд и не медоед.

The supplied artifact is a Linux executable named io_hrana.elf. The goal is to pass its local attestation logic and recover the hidden value without contacting any service.

Artifact provenance:

• Organizer artifact: https://avitoctf.ru/files/io_hrana.elf
• SHA-256: fdf40de61782db51155953b5a425b1871f705a43fd38aab9d3fb764eb214c451

Analysis

Binary triage and the execution dead end

The artifact is a static, stripped AMD64 ELF with NX, no PIE, and partial RELRO. Its main function spans 0x40b305..0x4f02a3; most of that range performs an enormous byte-at-a-time initialization of global state.

Running it under Docker/QEMU does not reach the useful behavior. At 0x4f4f8a, syscall 425 (io_uring_setup) returns ENOSYS. Static tracing showed that the binary prepares these io_uring operations:

• IORING_OP_STATX (21)
• IORING_OP_SOCKET (45)
• IORING_OP_CONNECT (16)
• IORING_OP_SEND (26)
• IORING_OP_WRITE (23)

Wrappers for IORING_OP_OPENAT (18) and IORING_OP_RENAMEAT (35) are also present. This implements local environment attestation and a Unix-socket exchange, but none of it needs to execute for the offline solve.

The decoy URL

An early routine at 0x402d30 XOR-decrypts the object at 0x5e3520 with the table at 0x5e1100. It produces a URL on a different origin, represented here as https://<DECOY_HOST_REDACTED>/.

That URL is not the answer. It was treated as untrusted anti-LLM bait and was never requested. A Capstone cross-reference audit also found only the two decryptor reads of the key object, proving that io_uring does not later fill or modify its unused tail.

Locating the real output

The decisive call is at 0x4f03f0..0x4f041b. It invokes the builder at 0x40a9f0 with this ABI state:

...