Want the flag?

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: ld_preload_injection, runtime_memory_modification, timing_based_bypass

Summary

Task: convince a binary with anti-cheat detection that you want the flag by matching a checker variable to a hardcoded string. Solution: use LD_PRELOAD to inject a constructor that overwrites the checker variable at its known address with the target string before the comparison runs.

Want the flag? — SPB CTF Pwn Season

Description

"Убедите бинарник, что ХОТИТЕ флаг" (Convince the binary that you WANT the flag)

Binary: mc2 — ELF 64-bit x86-64, not stripped (same as Task 1)

Analysis

The binary has a checker variable at address 0x60b040 that is compared against the string "I_WANT_THE_FLAG!". If they match, the function obfuscated_give_flag is called to print the flag.

Challenge: The checker is initialized to "dont_give_flag" and the binary has anti-cheat detection — simply patching the comparison or the binary triggers a "Cheater!!!" message. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

We used LD_PRELOAD to inject a shared library that hooks printf. The hook modifies the checker variable in memory AFTER the VM's prepare_memory function runs but BEFORE the strcmp check executes. This timing bypasses both the comparison check and the anti-cheat mechanism.

 c read-only • copy allowed Copy
// hook.c - LD_PRELOAD hook
#include <string.h>

void __attribute__((constructor)) init() {
    char *checker = (char *)0x60b040;
    strcpy(checker, "I_WANT_THE_FLAG!");
}

 bash read-only • copy allowed Copy
gcc -shared -fPIC -o hook.so hook.c
LD_PRELOAD=./hook.so ./mc2

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍