Challenge Context#

This was a small pwn challenge built around an integer overflow. The final state from the solve notes records the relevant arithmetic:

1
uint8_t value 250 + 16 = 266 % 256 = 10

Vulnerability / Core Idea#

The program used an 8-bit integer for a value that was later increased. In C-like semantics, an unsigned 8-bit integer wraps modulo 256:

1
250 + 16 = 266
2
266 mod 256 = 10

If the program expects the value to become 10, we can reach it with a larger-looking input because the type truncates it.

Exploitation#

The solve was to supply the value that triggers wraparound instead of trying to enter the target value directly:

1
input: 250
2
operation: +16
3
stored uint8_t result: 10

That satisfied the check and printed the flag.

Flag#

1
leet{M0W471N_M15r1_6H4D1_64N8_17174}

Lesson Learned#

Always reason about the storage type, not only the mathematical expression. Small integer types silently wrap unless the program checks bounds before arithmetic.

Cover: Wallhaven 3qwqld.