Challenge

A forking server with stack canaries, PIE, and full RELRO. Goal: read the flag file.

Approach

  1. Canary brute-force: The process fork()s on each connection, preserving the canary across forks. Brute-force the 8-byte canary one byte at a time (256 attempts per byte = 2048 total).
  2. Libc leak: With the canary known, overflow to control rip; call puts(puts@got) to leak a libc address.
  3. ORW ROP: With libc base known, build a ROP chain to open("flag.txt") → read(fd, buf, n) → write(1, buf, n).
1
2
3
4
5
6
7
8

# Canary brute (simplified)
canary = b""
for i in range(1, 8):
    for b in range(256):
        send_payload(b"A"*OFFSET + canary + bytes([b]))
        if not crashed():
            canary += bytes([b])
            break

Flag

boroCTF{H0LY_Y0U_@R3_TH3_G04T}