Ret2Win Overwrite

Category: PWN · Difficulty: Basic · Points: 100 · Challenge: 508

Background

A legacy management daemon running on internal infrastructure reads unchecked user input directly into a fixed-size stack frame. Overwrite the saved instruction pointer to redirect execution to the target function. FORMAT: FLAG{ }

---

Connection Target: nc pwn-066 9999

Operational Binary: vuln_app-66

Analysis

No executable was published. The evidence file is a report giving the name, size and digest of a binary that is not present, together with a full hexdump of its contents:

$ cat evidence.txt
artifact: vuln_app-66
size: 93 bytes
sha256: A544aa94f33c707b8bea1b99528c995f9aa087e80a958e2c87dbab941b8cef25
full hexdump:
00000000  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00  |.ELF............|
00000010  00 00 00 00 00 00 00 00 50 57 4e 5f 42 49 4e  |PWN_BINA|
00000020  52 59 5f 53 4f 43 4b 45 54 5f              |RY_SOCKET|
...

The dump is again the ELF identification string followed by the ASCII marker PWN_BINARY_SOCKET_66_ and then the flag, with NUL padding to the end. Since no program image exists locally, no overflow was triggered and no control flow was redirected, and the memory-safety behaviour named in the brief could not be reproduced. The digest is recorded above so that this report can be tied to one specific artifact.

The 93-byte object is not a loadable program image: the ELF header is followed by NUL bytes and an ASCII marker rather than by program headers or section data, so no saved return address could be located and no return address could be computed.

Result

FLAG{cwa2026_fcbe4783ea1f29c2}