zaq3m1hjx@mozmail.com's Mind the Stack

Author:
zaq3m1hjx@mozmail.com

Language:
C/C++

Upload:
2025-12-22 21:44

Download

Platform:
Unix/linux etc.

Difficulty:
4.0

Quality:
5.5

Arch:
x86-64

Downloads:
139

Size:
924.20 KB

Writeups:
1

Comments:
12

Description

The goal is to print the “Access Granted” message through whatever means necessary. While patching can solve this challenge in seconds, the intended solution rewards players who understand calling conventions, stack behavior, security mitigations, and how user input flows through a program at runtime.

Comments (12)
Writeups (1)

You must be logged in to post a comment

illusionxxx on 2025-12-23 09:28: so do i just need to brute hash with sha-256(salt_str + pass)?

illusionxxx on 2025-12-23 09:58: or to use buffer overflow variable overwrite?

zaq3m1hjx@mozmail.com on 2025-12-23 10:42: illusionxxx brute forcing the hash is certainly possible in theory, and fair if someone manages it. That said, the challenge is more about exploiting the vulnerabilities

Xkr0t0s on 2025-12-23 21:19: "Ohhhhhhhh fuck! Zaq3m1hjx@mozmail.com, can you please write a guide to show us how we should solve this challenge?"

Xkr0t0s on 2025-12-23 21:26: We cannot use Buffer Overflow here because of the Stack order. The target variable v23 is at a lower memory address (rbp-20h) than our input buffers v24 and v25. Since an overflow always writes forward (to higher addresses), it will only hit the Stack Canary and crash the program. It can never go backward to reach v23.

Xkr0t0s on 2025-12-23 21:27: I think we should use Format String ?

zaq3m1hjx@mozmail.com on 2025-12-24 19:41: @Xkr0t0s you're on right track, yes the buffer cannot overflow backwards, its not meant to be. Regarding stack canaries, you already answered it in your next comment. I'll post a detailed writeup by weekend

Xkr0t0s on 2025-12-25 20:08: @zaq3m1hjx@mozmail.com,Thank you so much for the quick response and for confirming my thoughts on the stack order and the Canary! It’s a very clever challenge. I’ve been trying to solve it using Format Strings as you suggested, but I'm hit with a bit of a roadblock. Since I couldn't find any writeups or similar solutions online for this specific scenario, I’m really eager to learn the correct methodology. If possible, could you please post the writeup a bit sooner? I’m very excited to see the "intended" way to exploit this. Thanks again for the great challenge!

zaq3m1hjx@mozmail.com on 2025-12-26 10:29: Xkr0t0s Sure I am working on the writeup, I'll be able to post it by tomorrow. I'd like to know your ideas if you don't mind

Xkr0t0s on 2025-12-26 10:55: Hi,zaq3m1hjx@mozmail.com After analyzing the AuthenticateUser function, my strategy is clear. Since v23 is located at a lower address (rbp-20h) than the input buffers, a traditional buffer overflow is ruled out due to the stack growth direction and the Stack Canary at rbp-8h. However, I spotted a Format String Vulnerability in the second _printf call where v25 is passed as the format argument. Interestingly, v23 is also passed as the 7th argument to that same printf call. My idea is to input a specific format string into v25 (like %1c%7$n) to trigger an Arbitrary Write. This will allow me to overwrite the value of v23 on the stack and set it to 1, effectively bypassing the checkPassword logic and triggering grantAccess(). What do u think ? is my ideas is true ?

zaq3m1hjx@mozmail.com on 2025-12-26 13:55: @Xkr0t0s your idea is solid, but for a %n attack to work, the address you want to overwrite must be already present somewhere in the stack which isn't in this case. Instead of dismissing the buffer overflow because it can't overwrite the v23, you can think of other things you can do with buffer overflow, while doing so you'll find the necessity of format string vulnerability. I also wrote a follow up puzzle https://crackmes.one/crackme/694d8f730c16072f40f5a424, which does align closely with the %n-style approach you’re describing. You’ll probably enjoy this one as well.

weerdmonk on 2025-12-29 12:23: Spoiler alert! Once you print the stack canary value exploiting the format string vulnerability overwrite the return address of AuthenticateUser with the address of grantAccess and voila! You need a Python script or another program to send hexadecimal data to the program.

You must be logged in to submit a writeup

Solution by zaq3m1hjx@mozmail.com on 2025-12-28 08:45:
Mind the stack writeup

Download