[WRITE UP] - UTCTF 2025
Tic Tac Toe
Challenge Description
Reverse Engineering
1 | int __fastcall __noreturn main(int argc, const char **argv, const char **envp) |
The above program simulates the game of Tic Tac Toe, and the player will play against the CPU. The special thing about this program is that it uses the gets function to get the data we enter, which can cause a Buffer Overflow. So with this error, we will be allowed to change any data on the stack we want. Since we cannot win against the CPU (we can only draw or lose somehow), we will find a way to interfere with the logic to make a move
And based on the program we can see it stores our moves in a variable and I renamed it to table. And the corresponding values that will be stored inside the table array are:
0means nothing1is the CPU’s move2is the player’s move
In addition, by exploiting the buffer overflow, we can write extra data beyond the memory set for the table array. This gives us the ability to change any number in the table. For example, we can change a cell from a CPU move (1) to a player move (2) or even to an empty cell (0). Since the program does not check how much data we enter with the gets function, we can plan our input carefully to change the game state in our favor. This simple trick allows us to interfere with the game logic and create a win condition that was not originally possible.
And the program will check if someone wins after each move by looking at the table array. It searches for three of the same numbers in a row by checking the rows, columns, and both diagonals. If three cells in any of these lines have the same number, the program declares that side as the winner. This method is simple and clear because it directly shows whether a move leads to a win or not. The rules used are the basic rules of Tic Tac Toe, and by checking the table in this way, the game stays true to its original design. However, if we use a buffer overflow to change the values in the table, we can trick the program into thinking we have three in a row, even if we did not make the moves normally. This approach ultimately gives us a way to win the game.
Exploit Development
The idea is that all we need to do is change the value of table, to direct the move of CPU. Here we will put the payload at spot3 (rsp+0x5) so the offsets here must be subtracted by 5 to align it to the correct position.
1 | #!/usr/bin/env python3 |
Get flag
1 | ┌─ [23:38] ❄ alter in ~/CTFs/2025/UTCTF/pwn/TicTacToe |
RETirement Plan
Challenge Description
Reverse Engineering
1 | └ ϟ checksec shellcode took 88.630s |
1 | int __fastcall main(int argc, const char **argv, const char **envp) |
The program pretty simple, just get our input by using gets and our input goes through each character in the string format_1. For every character, it checks if it is an uppercase or a lowercase letter. If the character is uppercase, the code changes its value to -101 minus its original value. If the character is lowercase, it changes its value to -37 minus its original value. In short, it transforms each letter into a new negative value based on whether it is uppercase or lowercase. And then it print our input.
Exploit Development
As we can see we have 2 bugs here, Buffer Overflow and Format String Bug, our problem is that for loop, it’ll encrypt our input, so what we need to do with it? If we look carefully at the disassembly we can see
The program first moves our input pointer into the local variable at rbp-0x10. This location (rbp-0x10) is then used by the for loop to read each character of our input. During that loop, the code applies its encryption/decryption logic by changing each character’s value based on whether it is uppercase or lowercase. As a result, our input is modified before it is used in the program, so we need to be aware that our original string will not remain the same once it passes through this loop.
And because that pointer is on the stack so we can modified it point to some rw- section so that our input won’t be change by that loop. And what we need to do after that is just leak the stack address, put shellcode and calculate the address to return to it.
1 | #!/usr/bin/env python3 |
P/s: The offset in remote might be different from local so we need to calculate and adjust your payload if your leak is wrong
Get flag
1 | └ ϟ ./xpl.py REMOTE challenge.utctf.live 9009 |
secbof
Challenge Description
Reverse Engineering
1 | [*] '/home/alter/CTFs/2025/UTCTF/pwn/secbof/chal' |
1 | int __fastcall main(int argc, const char **argv, const char **envp) |
The program is simple just get our input using read and we have Buffer Overflow here, and we see that it have install_filter() function here so maybe it has seccomp rule (we need to check it)
1 | └ ϟ seccomp-tools dump ./chal took 82.295s |
Exploit Development
And yep, the seccomp just allow orw syscall, and because this is a static binary so we have all gadgets we need here.
1 | #!/usr/bin/env python3 |
My exploit is pretty complicated because I couldn’t find mov qword ptr [rdi], rdx; ret gadget the first time I did it… So I do pivot
Get flag
1 | ┌─ [0:03] ❄ alter in ~/CTFs/2025/UTCTF/pwn/secbof ⚲ |
- Title: [WRITE UP] - UTCTF 2025
- Author: *ptr
- Created at : 2025-03-17 11:55:00
- Updated at : 2025-04-04 01:21:55
- Link: https://5o1z.github.io/2025/03/17/2025/UTCTF/index/
- License: This work is licensed under CC BY-NC-SA 4.0.