← Back to CRACKON CTF

PWNEasy

PWN!

100 points

A Pwn challenge. Provide a calculated relative negative offset to jump execution from main to the print_flag function.

Tools Used

objdumpnetcatPython

Overview

A 64-bit ELF binary with PIE enabled. The program asks for a hex offset from main and executes a function call to it.

Reconnaissance

Disassembling the binary with objdump reveals three functions:

main (offset 0x127e)
get_flag (offset 0x12ed)
print_flag (offset 0x11e9)

Exploitation Strategy

The logic computes: Target = main + user_input.

Since the relative distance between print_flag and main is constant regardless of PIE randomization, we compute:

0x11e9 - 0x127e = -0x95

By sending -95 (hex -0x95) to the prompt, we trigger a call directly into print_flag.

Solution Code

echo '-95' | nc 20.197.42.57 2223

Flag

CrackOn{-OFfSeT}