incunabula — Pwn (ret2libc)

Lab: FlagYard Lab 5 (PWN) · Points: 300

Summary

A stripped binary with a buffer overflow and a puts call we can abuse to leak a libc address from the GOT. Classic ret2libc: leak puts → compute system and /bin/sh → return into system("/bin/sh").

Steps

1. Overflow to ROP: pop rdi; ret gadget + GOT entry of puts + puts@plt + main.
2. Parse leaked address, derive libc base from known offset.
3. Second overflow: pop rdi; ret + bin_sh + system.
4. Shell → read flag.

Flag

FlagY{aa78a3b3cfc9bf5b46b24e28d415246c984b186742bde392bd17d9ec6675d97c} — submitted, +300.

Lesson

If you have any libc function leaking, you own the box. Always check for a puts/printf GOT entry you can leak through.