Author:
zaq3m1hjx@mozmail.com

Language:
C/C++

Upload:
9:44 PM 12/22/2025

Download

Platform
Unix/linux etc.

Difficulty:
5.0

Quality:
4.0

Arch:
x86-64

Description

The goal is to print the “Access Granted” message through whatever means necessary. While patching can solve this challenge in seconds, the intended solution rewards players who understand calling conventions, stack behavior, security mitigations, and how user input flows through a program at runtime.

• Comments (7)
• Writeups (0)

You must be logged in to post a comment

illusionxxx on 9:28 AM 12/23/2025: so do i just need to brute hash with sha-256(salt_str + pass)?

illusionxxx on 9:58 AM 12/23/2025: or to use buffer overflow variable overwrite?

zaq3m1hjx@mozmail.com on 10:42 AM 12/23/2025: illusionxxx brute forcing the hash is certainly possible in theory, and fair if someone manages it. That said, the challenge is more about exploiting the vulnerabilities

Xkr0t0s on 9:19 PM 12/23/2025: "Ohhhhhhhh fuck! Zaq3m1hjx@mozmail.com, can you please write a guide to show us how we should solve this challenge?"

Xkr0t0s on 9:26 PM 12/23/2025: We cannot use Buffer Overflow here because of the Stack order. The target variable v23 is at a lower memory address (rbp-20h) than our input buffers v24 and v25. Since an overflow always writes forward (to higher addresses), it will only hit the Stack Canary and crash the program. It can never go backward to reach v23.

Xkr0t0s on 9:27 PM 12/23/2025: I think we should use Format String ?

zaq3m1hjx@mozmail.com on 7:41 PM 12/24/2025: @Xkr0t0s you're on right track, yes the buffer cannot overflow backwards, its not meant to be. Regarding stack canaries, you already answered it in your next comment. I'll post a detailed writeup by weekend

You must be logged in to submit a writeup