Subject Encallment

Description

If there's something strange. In your neighborhood. Who you gonna call?

Attachment: chall

Flag

TCP1P{here_my_number_so_call_me_maybe}

Solution

Running chall binary with gdb, set breakpoint main+34, change RIP to jump printFlag function.

0000000000001ba5 <printFlag>:
    1ba5:       55                      push   rbp
    1ba6:       48 89 e5                mov    rbp,rsp
    1ba9:       48 81 ec b0 00 00 00    sub    rsp,0xb0
(snip)

00000000000011a9 <secretFunction>:
    11a9:       55                      push   rbp
    11aa:       48 89 e5                mov    rbp,rsp
    11ad:       48 83 ec 10             sub    rsp,0x10
(snip)

0000000000001e22 <main>:
    1e22:       55                      push   rbp
    1e23:       48 89 e5                mov    rbp,rsp
    1e26:       48 8d 05 73 05 00 00    lea    rax,[rip+0x573]        # 23a0 <_IO_stdin_used+0x3a0>
    1e2d:       48 89 c7                mov    rdi,rax
    1e30:       e8 0b f2 ff ff          call   1040 <puts@plt>
    1e35:       bf 02 00 00 00          mov    edi,0x2
    1e3a:       e8 51 f2 ff ff          call   1090 <sleep@plt>
    1e3f:       b8 00 00 00 00          mov    eax,0x0
    1e44:       e8 60 f3 ff ff          call   11a9 <secretFunction>
    1e49:       bf 02 00 00 00          mov    edi,0x2
    1e4e:       e8 3d f2 ff ff          call   1090 <sleep@plt>
    1e53:       b8 00 00 00 00          mov    eax,0x0
    1e58:       5d                      pop    rbp
    1e59:       c3                      ret

input in gdb:

disas main
b *main+34
r
tele 0x555555555ba5
set $rip=0x555555555ba5
c
gdb-peda$ c
Continuing.
TCP1P{here_my_number_so_call_me_maybe}

Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x1
RBX: 0x7fffffffdd58 --> 0x7fffffffe10e ("/root/ctf/TCP1PCTF_2023/rev/Subject_Encallment/chall")
RCX: 0x7ffff7eb8b00 (<__GI___libc_write+16>:    cmp    rax,0xfffffffffffff000)
RDX: 0x0
RSI: 0x5555555592a0 ("TCP1P{here_my_number_so_call_me_maybe}\n")
RDI: 0x7ffff7f96a30 --> 0x0
RBP: 0x7fffffffdc40 --> 0x1
RSP: 0x7fffffffdc48 --> 0x7ffff7de86ca (<__libc_start_call_main+122>:   mov    edi,eax)
RIP: 0x1
R8 : 0x400
R9 : 0x410
R10: 0x7ffff7dcedc8 --> 0x10001200003292
R11: 0x202
R12: 0x0
R13: 0x7fffffffdd68 --> 0x7fffffffe143 ("COLORFGBG=15;0")
R14: 0x555555557dd8 --> 0x555555555160 (<__do_global_dtors_aux>:        endbr64)
R15: 0x7ffff7ffd000 --> 0x7ffff7ffe2d0 --> 0x555555554000 --> 0x10102464c457f
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
Invalid $PC address: 0x1
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffdc48 --> 0x7ffff7de86ca (<__libc_start_call_main+122>:  mov    edi,eax)
0008| 0x7fffffffdc50 --> 0x7fffffffdd40 --> 0x7fffffffdd48 --> 0x7ffff7fc3160 --> 0x7ffff7dc1000 --> 0x3010102464c457f
0016| 0x7fffffffdc58 --> 0x555555555e22 (<main>:        push   rbp)
0024| 0x7fffffffdc60 --> 0x155554040
0032| 0x7fffffffdc68 --> 0x7fffffffdd58 --> 0x7fffffffe10e ("/root/ctf/TCP1PCTF_2023/rev/Subject_Encallment/chall")
0040| 0x7fffffffdc70 --> 0x7fffffffdd58 --> 0x7fffffffe10e ("/root/ctf/TCP1PCTF_2023/rev/Subject_Encallment/chall")
0048| 0x7fffffffdc78 --> 0x50c157b89c9dbf5
0056| 0x7fffffffdc80 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x0000000000000001 in ?? ()
gdb-peda$