picoCTF - Binary Exploitation

Quizploit Writeup

picoCTF Quizploit writeup exploiting a quiz application through buffer overflow to redirect execution and capture the flag.

#picoctf#binary-exploitation#pwn
Contents

Quizploit Writeup

Here is the exact writeup of how I solved it, step by step, including the tools I used.

Files and tools used

  • Files: vuln, vuln.c
  • Tools:
  • file
  • checksec
  • objdump
  • gdb-pwndbg
  • nc

1) Inspect binary basics

file vuln

From this, answer architecture/linking/stripped questions.

2) Check protections

checksec --file=vuln

Use this for NX/protection questions.

3) Read source for buffer and read size

cat vuln.c

Extract:

  • buffer size in vuln()
  • input read size
  • overflow amount (read_size - buffer_size)

4) Confirm symbols and win function

objdump -d vuln | rg "<win>|<vuln>|<main>"

Or in GDB:

gdb-pwndbg vuln
info functions

5) Connect and answer quiz

nc lonely-island.picoctf.net 56027

I answered using values collected from the commands above.

Final answers used (solved run)

  • 64-bit
  • dynamic
  • not stripped
  • 0x15
  • 0x90
  • yes
  • fgets
  • win
  • buffer overflow
  • 0x7b
  • NX
  • ROP
  • 0x401176

Final flag

picoCTF{<redacted>}

Related research

picoCTF - Binary Exploitation

Echo Escape 1 Writeup

picoCTF Echo Escape 1 writeup leveraging format string bugs in an echo service to read sensitive memory and extract the flag.

Read →
picoCTF - Binary Exploitation

Echo Escape 2 Writeup

picoCTF Echo Escape 2 writeup using format string vulnerabilities to leak and overwrite memory for shell access.

Read →
picoCTF - Binary Exploitation

Heap Havoc Writeup

picoCTF Heap Havoc writeup exploiting heap memory management flaws including use-after-free or heap overflow to gain code execution.

Read →
picoCTF - Binary Exploitation

offset-cycle Writeup

picoCTF Offset Cycle writeup solving a binary exploitation challenge involving cyclic offset calculation and return address control.

Read →