/..

#CONTENT

#TOP

chal
16 KiB2024-02-29 21:34
chal.c
886 bytes2024-02-29 21:34
Dockerfile
134 bytes2024-02-29 21:34
flag.txt
55 bytes2024-02-29 21:34
Makefile
440 bytes2024-02-29 21:34
README.mdx
2 KiB2024-08-23 05:19

#Provided Files

#chal decompilation

int32_t main(int32_t argc, char** argv, char** envp)
    int32_t var_4c = argc
    void* fsbase
    int64_t rax = *(fsbase + 0x28)
    setbuf(fp: stdout, buf: nullptr)
    setbuf(fp: stderr, buf: nullptr)
    puts(str: "I'm sure you all enjoy doing she…")
    puts(str: "But have you ever tried ELF golf…")
    puts(str: "Have fun!")
    int32_t rax_1 = memfd_create("golf", 0)
    if (rax_1 s< 0) {
        perror(s: "failed to execute fd = memfd_cre…")
        exit(status: 1)
        noreturn
    }
    void var_38
    int32_t rax_2 = read(fd: 0, buf: &var_38, nbytes: 0x20)
    if (rax_2 s< 0) {
        perror(s: "failed to execute ok = read(0, b…")
        exit(status: 1)
        noreturn
    }
    printf(format: "read %d bytes from stdin\n", zx.q(rax_2))
    int32_t rax_7 = write(fd: rax_1, buf: &var_38, nbytes: sx.q(rax_2))
    if (rax_7 s< 0) {
        perror(s: "failed to execute ok = write(fd,…")
        exit(status: 1)
        noreturn
    }
    printf(format: "wrote %d bytes to file\n", zx.q(rax_7))
    if (fexecve(fd: rax_1, argv, envp) s< 0) {
        perror(s: "failed to execute fexecve(fd, ar…")
        exit(status: 1)
        noreturn
    }
    *(fsbase + 0x28)
    if (rax == *(fsbase + 0x28)) {
        return 0
    }
    __stack_chk_fail()
    noreturn

#Intended

In the decompilation, the binary is reading and executing a file using memfd_create and fexecve. This is a method of executing binaries without making a file on the filesystem, it exists only in memory. The challenge only allows binaries of maxiumum size of 32 and making a valid ELF this small should be impossible. The problem is that remote does not validate that the given file is actually an ELF file (it should start with at least b'\x7FELF') and you can put a shebang instead to get a shell.

#Solution

#!/bin/sh

cat flag.txt

#Unintendeds

No unintendeds to see here!