Baby Pwn — fortid2026

Description

Everyone's opinion matters to us. Submit a review, save your thoughts for later, and make sure your favourite feedback is never forgotten. Can you leave one last review?

A handout.zip contained chall.c (source) and chall (ELF 64-bit). The service was reachable over TLS (ncat --ssl ... 1337). Goal: hijack a dangling function pointer through a use-after-free to call the built-in win() function and read flag.txt.

Analysis

Binary facts (readelf -h / checksec):

• ELF 64-bit x86-64, dynamically linked, not stripped.
• Non-PIE (e_type = EXEC), so function addresses are fixed — no leak needed.
• win() at 0x40135f — opens flag.txt and prints its contents.
• show_review() at 0x401336 — the normal display handler.

Vulnerable data model (from chall.c):

#define REVIEW_TEXT_SIZE 32
struct review {
    char text[REVIEW_TEXT_SIZE];          // offset 0, 32 bytes
    void (*display)(review_t *review);    // offset 32, function pointer
};
// draft is a raw byte buffer of EXACTLY the same size as review_t (40 bytes)
typedef struct { char contents[sizeof(review_t)]; } draft_t;

static review_t *review;
static review_t *favourite;
static draft_t  *draft;

Menu behaviour:

1. submit_review() — review = malloc(sizeof(review_t)), reads text, sets review->display = show_review.
2. mark_favourite() — favourite = review (just aliases the pointer, no copy).
3. delete_review() — free(review); review = NULL; but favourite is left dangling.
4. write_draft() — draft = malloc(sizeof(draft_t)), user supplies a length 1..40 and that exact many bytes via fread (so NUL bytes are allowed).
5. preview_favourite() — favourite->display(favourite) — an indirect call through a possibly-freed chunk.

Root cause — Use-After-Free + pointer aliasing:

delete_review() frees the review chunk and nulls review, but mark_favourite() earlier copied the pointer into favourite, which is never cleared. favourite therefore dangles into a freed chunk.

...