All rooms Sign in
Binary ExploitationLesson + challenge Live machineFree

Ghost in the Stack

No win() to jump to. Borrow the library's code instead.

A step up from ret2win: there is no win() function. Use a libc pointer the service leaks to defeat ASLR, then build a ret2libc ROP chain (pop rdi; /bin/sh; system) to pop a shell and read the flag. The binary and its libc are provided.

Difficulty
Medium
Estimated time
60 min
Points
275 pts
Completions
Completed by 1 player
Authors
By Cyber Academy 4 U
Create a free account to startSign in

What you will learn

  • Turn a single leaked pointer into the full libc base (defeat ASLR)
  • Resolve system(), the /bin/sh string, and gadgets from a real libc.so.6
  • Build and fire a pop rdi; /bin/sh; system ret2libc chain
  • Handle modern glibc's 16-byte stack-alignment requirement

What is inside

  1. Task 1 · Ghost in the Stack1 question

Sign in to read the tasks, start the machine and answer the questions.